Apache Tomcat Patches Important Remote Code Execution Flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-12615 | Unauthenticated RCE in Apache Tomcat 7 on Windows via HTTP PUT (CVE-2017-12615) Apache Tomcat 7.0.0 through 7.0.79 running on Windows with HTTP PUT enabled on the Default servlet (the readonly initialisation parameter set to false, which is not the default configuration) allows an unauthenticated attacker to upload a JSP file via a specially crafted PUT request (CWE-434), bypassing the extension check (e.g. via trailing-slash or case variations). The uploaded JSP can then be requested, and any code it contains is executed in the Tomcat server context, giving the attacker unauthenticated remote code execution. Only Tomcat 7 deployments on Windows with PUTs enabled are directly affected; because bundled Tomcat is also shipped in products from Red Hat (JBoss Enterprise Web Server, RHEL variants) and NetApp, those vendors issued advisories as well. This flaw is closely related to CVE-2017-12617, which was reported and patched around the same time. Exploitation is confirmed in the wild: it was added to CISA KEV on 2022-03-25 with known ransomware use, has two public proof-of-concept references, and EPSS assigns a 99.6% probability of exploitation within 30 days. Do: Upgrade Tomcat beyond the affected 7.0.0–7.0.79 range per vendor instructions (Apache Tomcat directly, or via Red Hat JBoss Enterprise Web Server/RHEL and NetApp bundled-product advisories), prioritizing internet-facing Windows servers since the issue is KEV-listed with known ransomware use. If patching must be delayed, ensure the Default servlet readonly parameter remains at its default (true) to disable PUT, or block PUT requests at a reverse proxy/WAF on Windows Tomcat hosts. Also check affected Windows hosts for unexpectedly uploaded .jsp files and review access logs for PUT requests that created JSPs, as indicators of compromise. | 8.1 | 100% | KEV ransomware PoC ×2 |
| large≈10,000–100,000 exposed systems (Tomcat 7 on Windows with non-default PUT enabled) | |
| CVE-2017-12617 | Apache Tomcat Remote Code Execution Vulnerability CVE-2017-12617 is a file-upload vulnerability (CWE-434) in Apache Tomcat in which a specially crafted request can upload a JSP file to the server, and any code in that file is executed when the file is later requested, enabling remote code execution. Any organization running an affected version of Apache Tomcat is exposed. Because it allows arbitrary code execution on the web server, it can lead to full server compromise, and it is listed in CISA's Known Exploited Vulnerabilities catalog with a maximal 100% EPSS probability of exploitation within 30 days. Do: Apply updates to Apache Tomcat per vendor instructions, which is the required action for this CISA KEV-listed vulnerability. Prioritize patching internet-facing Tomcat instances given the very high likelihood of exploitation, and review patched servers for unexpected or recently created JSP files that could indicate prior exploitation. | 8.1 | 100% | KEV |
| — |
Full article476 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalOct 05, 2017
The Apache Tomcat team has recently patched several security vulnerabilities in Apache Tomcat, one of which could allow an unauthorised attacker to execute malicious code on affected servers remotely.
Apache Tomcat, developed by the Apache Software Foundation (ASF), is an open source web server and servlet system, which uses several Java EE specifications like Java Servlet, JavaServer Pages (JSP), Expression Language, and WebSocket, and provides a "pure Java" HTTP web server environment for Java concept to run in.
Unlike Apache Struts2 vulnerabilities, which have recently been exploited to breach the systems of American credit reporting agency Equifax, Apache Tomcat flaws are less likely to be exploited.
The critical Remote Code Execution (RCE) vulnerability (CVE-2017-12617) discovered in Apache Tomcat is due to insufficient validation of user-supplied input by the affected software.
Only systems with HTTP PUTs enabled (via setting the "read-only" initialization parameter of the Default servlet to "false") are affected.
"Tomcat versions before 9.0.1 (Beta), 8.5.23, 8.0.47 and 7.0.82 contain a potentially dangerous remote code execution (RCE) vulnerability on all operating systems if the default servlet is configured with the parameter readonly set to false or the WebDAV servlet is enabled with the parameter readonly set to false," says Peter Stöckli of Alphabot Security.
Exploiting this vulnerability requires an attacker to upload a maliciously crafted Java Server Page (JSP) file to a targeted server running an affected version of Apache Tomcat, and the code contained in the JSP file would be executed by the server when the file is requested.
To upload the maliciously crafted JSP, the attacker just needs to send an HTTP PUT request to the vulnerable server, as mentioned in the proof-of-concept (PoC) exploit code published by Peter on the Apache mailing list.
The exploit would eventually allow the attacker to execute malicious code on the targeted server.
"Since this feature is typically not wanted, the most publicly exposed system will not have readonly set to false and are thus not affected," Peter explains.
This RCE vulnerability, marked as "important," impacts all Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81, and has been addressed with the release of Tomcat versions 9.0.1 (Beta), 8.5.23, 8.0.47 and 7.0.82.
A similar security issue (CVE-2017-12615) discovered in Tomcat 7 on Windows was patched by the Apache Tomcat developers on September 19 with the release of version 7.0.81.
Administrators are strongly recommended to apply the software updates as soon as possible and are advised to allow only trusted users to have network access as well as monitor affected systems.
The researchers have not detected any incident of the exploitation of one of these Apache Tomcat vulnerabilities in the wild.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2017/10/apache-tomcat-rce.html