CyberSecBulletin
CVE-2017-12617Exploited in the wildNVD status: Analyzed

Apache Tomcat Remote Code Execution

Published Updated By the CyberSecBulletin desk

CVE-2017-12617 is a high-severity unrestricted upload of file with dangerous type vulnerability in Apache Tomcat from Apache, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Apache Tomcat versions: 9.0.0.M1 to 9.0.0; 8.5.0 to 8.5.22; 8.0.0.RC1 to 8.0.46, and others listed below. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on March 25, 2022, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update Tomcat to 7.0.82 or 8.0.47 or 8.5.23 or 9.0.1, whichever matches your release line, or a later version.
  2. CISA's required action: Apply updates per vendor instructions.
  3. Read the advisory on oracle.com for workarounds and exact fixed builds.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
ApacheApache Tomcat9.0.0.M1 to 9.0.0; 8.5.0 to 8.5.22; 8.0.0.RC1 to 8.0.46; 7.0.0 to 7.0.81Not stated
ApacheTomcat7.0.0 up to, but not including, 7.0.82; 8.0 up to, but not including, 8.0.47; 8.5.0 up to, but not including, 8.5.23; 9.0.0 up to, but not including, 9.0.17.0.82, 8.0.47, 8.5.23, 9.0.1
CanonicalUbuntu Linux12.04; 16.04; 17.10; 18.04Not stated
OracleAgile Product Lifecycle Management9.3.3; 9.3.4; 9.3.5; 9.3.6Not stated
OracleCommunications Instant Messaging Server10.0.1Not stated
OracleEndeca Information Discovery Integrator3.1.0; 3.2.0Not stated
OracleEnterprise Manager For MySQL Database12.1.0.4.0Not stated
OracleFinancial Services Analytical Applications Infrastructure7.3.3.0.0 through 7.3.5.3.0; 8.0.0.0.0 through 8.0.9.0.0Not stated
OracleFmw Platform12.2.1.2.0; 12.2.1.3.0Not stated
OracleHealth Sciences Empirica Inspections1.0.1.1Not stated
OracleHospitality Guest Access4.2.0; 4.2.1Not stated
OracleInstantis Enterprisetrack17.1; 17.2Not stated
OracleManagement Pack11.2.1.0.13Not stated
OracleMicros Lucas2.9.5Not stated
OracleMicros Retail Xbri Loss Prevention10.0.1; 10.5.0; 10.6.0; 10.7.0; 10.8.0; 10.8.1Not stated
OracleMySQL Enterprise Monitor3.3.6.3293 and earlier; 3.4.0 through 3.4.4.4226; 4.0.0 through 4.0.0.5135Not stated
OracleRetail Advanced Inventory Planning13.2; 13.4; 14.1; 15.0Not stated
OracleRetail Back Office14.0.4; 14.1.3Not stated
OracleRetail Central Office14.0.4; 14.1.3Not stated
OracleRetail Convenience And Fuel Pos Software2.1.132Not stated
OracleRetail Eftlink1.1.124; 15.0.1; 16.0.2Not stated
OracleRetail Insights14.0; 14.1; 15.0; 16.0Not stated
OracleRetail Invoice Matching12.0; 13.0; 13.1; 13.2; 14.0; 14.1; 15.0; 16.0Not stated
OracleRetail Order Broker5.0; 5.1; 5.2; 15.0; 16.0Not stated
OracleRetail Order Management System4.0; 4.5; 4.7; 5.0Not stated

Version data comes from the organisation that assigned the CVE; 34 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.18.1HighNVD
CVSS 3.18.1HighCISA (ADP)
CVSS 2.06.8MediumNVD

Official description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

How developers prevent this class of flaw

  • Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.
  • When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
  • Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.

More Unrestricted Upload of File with Dangerous Type vulnerabilities (CWE-434)

Timeline

  1. CVE record published.
  2. Added to CISA's Known Exploited Vulnerabilities catalogue.
  3. Deadline for US federal agencies to remediate, set by CISA.
  4. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
  5. Record last changed materially (score, affected products, status or references).

References

Patches and release notes

Third-party and government advisories

Technical write-ups (may include proof of concept)

Other vulnerabilities in Apache Tomcat

All Apache Tomcat vulnerabilities

Recent Unrestricted Upload of File with Dangerous Type vulnerabilities

Spotted an error? Tell us.