CVE-2017-12615

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g (CVE-2017-12615)

criticalRansomware KEV: actively exploited PoC EPSS 100%

Description

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Source: CVELISTV5 CISA_KEV NVD CVEORG OSV

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2017-12615 carries a CVSS 8.1 (High) score and sits at the 100th EPSS percentile, reflecting the wide availability of weaponised exploits in public frameworks such as Metasploit. CISA has flagged it for confirmed use in ransomware campaigns, meaning successful exploitation is not merely theoretical — it is a documented initial-access vector leading to full system compromise. The AC:H component of the CVSS vector reflects the requirement for a non-default configuration (readonly=false), but this setting is found in many legacy deployments where developers enabled it for convenience and never reverted it. Organisations running older Tomcat 7.x instances in SAP landscapes (Red Hat RHEL for SAP) or relying on NetApp products that bundle Tomcat should treat this as a critical finding and prioritise patching or the PUT-disable compensating control above other routine vulnerability work.

Runbook · Step 1

Immediate response (0-24 h)

Apply the patch: Upgrade Apache Tomcat to 7.0.81 or later (7.0.80 contains the initial fix; 7.0.81 closes a bypass). For Red Hat environments, apply RHSA-2017:2493 or RHSA-2017:3080 for JBoss Enterprise Web Server.
Disable HTTP PUT immediately: In the DefaultServlet configuration inside web.xml, set the readonly init parameter to true (the default) or remove it entirely — this is the most effective compensating control if patching cannot happen within the hour.
Isolate exposed hosts: Segment Windows hosts running Tomcat 7.0.0–7.0.79 with HTTP PUT enabled away from the internet and DMZ until patched.
Audit the webroot for uploaded JSPs: Inspect all Tomcat-writable directories (especially webapps/ROOT/) for newly created or modified .jsp and .jspx files — prioritise timestamps within the last 72 hours.
Check NetApp products: 7-Mode Transition Tool, OnCommand Balance, and OnCommand Shift bundle Tomcat internally — verify patch status against the NetApp vendor advisory and apply the vendor-supplied fix.

Runbook · Step 2

Mitigation layers

WAF/reverse proxy method restriction: Limit allowed HTTP methods to GET, POST, and HEAD at the perimeter; block PUT, DELETE, and PATCH. Nginx example: limit_except GET POST HEAD { deny all; }. Suricata/Snort: alert on HTTP PUT requests with .jsp or .jspx in the URI.
Network segmentation: Restrict Tomcat listener ports (default 8080/tcp, 8443/tcp) to internal management VLANs only; no direct internet exposure.
Filesystem hardening: Remove write permissions on the webapps/ directory tree from the Tomcat service account if hot-deploy is not required. On Windows, enforce restrictive NTFS ACLs.
IPS signature: Create a Snort/Suricata rule matching HTTP PUT requests where the URI ends in .jsp or .jspx and the Content-Type is application/octet-stream or text/plain — this covers the canonical exploit payload pattern.
Least-privilege service account: Run the Tomcat Windows service under a dedicated account with no local administrator rights; this limits post-exploitation lateral movement if a webshell is successfully uploaded.

Runbook · Step 3

Detection rules

Web server access log: HTTP PUT requests returning status 201 or 204 on paths ending in .jsp — SPL: index=webserver method=PUT uri="*.jsp" (status=201 OR status=204).
Filesystem monitoring (Sysmon EID 11): TargetFilename contains webapps and ends with .jsp or .jspx, created by the Tomcat process (catalina.bat, java.exe) — Sigma shape: EventID: 11 | TargetFilename|contains: 'webapps' | TargetFilename|endswith: '.jsp'.
Process ancestry (Sysmon EID 1): java.exe or tomcat*.exe as parent of cmd.exe, powershell.exe, or wscript.exe — strong indicator of JSP webshell execution.
Network telemetry (Zeek/Suricata): HTTP method PUT with URI suffix .jsp or .jspx — Zeek filter: http.method == "PUT" && /\.(jsp|jspx)$/.test(http.uri).
Windows Security Event Log EID 4663: Write access to files under the Tomcat webapps directory by the Tomcat service account outside of scheduled deployment windows.

Metrics

Severity

critical

Priority score

200.46

KEV status

Actively exploited

Exploit maturity

actively exploited (KEV)

XIEM Effective CVSS

8.1

Source: nvd-v3

CVSS v3

8.1

CVSS v4

—

EPSS percentile

100.0 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

99.6 %

High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

Published

2017-09-19 13:00 UTC

CWE

—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

CVE Modified2026-08-06 05:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
- SSVC: {"id":"CVE-2017-12615","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica… → {"id":"CVE-2017-12615","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica…
CVE Modified2026-08-05 20:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
- SSVC: {"id":"CVE-2017-12615","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"slow"},{"techni… → {"id":"CVE-2017-12615","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica…

Affected operating systems

linux
redhat / enterprise_linux_desktop6.0
linux
redhat / enterprise_linux_desktop7.0
linux
redhat / enterprise_linux_eus7.4
linux
redhat / enterprise_linux_eus7.5
linux
redhat / enterprise_linux_eus7.6
linux
redhat / enterprise_linux_eus7.7
linux
redhat / enterprise_linux_eus_compute_node7.4
linux
redhat / enterprise_linux_eus_compute_node7.5
linux
redhat / enterprise_linux_eus_compute_node7.6
linux
redhat / enterprise_linux_eus_compute_node7.7
linux
redhat / enterprise_linux_for_ibm_z_systems7.0_s390x
linux
redhat / enterprise_linux_for_ibm_z_systems_eus7.4_s390x
linux
redhat / enterprise_linux_for_ibm_z_systems_eus7.5_s390x
linux
redhat / enterprise_linux_for_ibm_z_systems_eus7.6_s390x
linux
redhat / enterprise_linux_for_ibm_z_systems_eus7.7_s390x
linux
redhat / enterprise_linux_for_power_big_endian7.0_ppc64
linux
redhat / enterprise_linux_for_power_big_endian_eus7.4_ppc64
linux
redhat / enterprise_linux_for_power_big_endian_eus7.5_ppc64
linux
redhat / enterprise_linux_for_power_big_endian_eus7.6_ppc64
linux
redhat / enterprise_linux_for_power_big_endian_eus7.7_ppc64
linux
redhat / enterprise_linux_for_power_little_endian7.0_ppc64le
linux
redhat / enterprise_linux_for_power_little_endian_eus7.4_ppc64le
linux
redhat / enterprise_linux_for_power_little_endian_eus7.5_ppc64le
linux
redhat / enterprise_linux_for_power_little_endian_eus7.6_ppc64le

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

apache
tomcat7.0.0 – 7.0.79
netapp
7-mode_transition_tool
netapp
oncommand_balance
netapp
oncommand_shift
redhat
enterprise_linux_server_update_services_for_sap_solutions
redhat
jboss_enterprise_web_server
redhat
jboss_enterprise_web_server_text-only_advisories

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

CISA KEV Catalogactively exploited (KEV)
CISA Known Exploited Vulnerabilityhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog#CVE-2017-126152022-03-25 00:00 UTC

References & sources

IDCVE-2017-12615