Remote Code Execution Vulnerability in Apache Tomcat on Windows
CVE-2017-12615

8.1HIGH

Key Information:

Vendor: Apache
Status: Apache Tomcat
Vendor: CVE Published:; 19 September 2017

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 99%🦅 CISA Reported

What is CVE-2017-12615?

A security vulnerability exists in Apache Tomcat versions 7.0.0 through 7.0.79 on Windows when HTTP PUT requests are enabled. This flaw allows an attacker to upload a malicious JSP file to the server through crafted requests. If successfully executed, the uploaded JSP file can be accessed and run on the server, which may lead to unauthorized code execution and compromise the system.

CISA has reported CVE-2017-12615

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2017-12615 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Apache Tomcat 7.0.0 to 7.0.79

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2017-12615 - Proof of Concept

CVE-2017-12615
Created by breaktoprotect

Tomcat_PUT_GUI_EXP
Created by xiaokp7