Intel

CVE-2017-12617

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g (CVE-2017-12617)

criticalKEV: actively exploitedPoCEPSS 100%

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Source: CVELISTV5OSVCISA_KEVNVDCVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2017-12617 carries an EPSS score of 0.9999 at the 100th percentile, meaning exploit-prediction models assign near-certain active exploitation probability — a finding corroborated by CISA's KEV listing. Although the CVSS v3 score of 8.1 (AV:N/AC:H) reflects the prerequisite of a non-default configuration (HTTP PUT enabled), this configuration is common in legacy Java application stacks and CI/CD pipelines that use Tomcat as a deployment target, making real-world exposure broader than the Attack Complexity rating implies. Successful exploitation requires no authentication and yields full remote code execution, enabling complete host compromise. Organisations running internet-facing Tomcat instances — particularly in NIS2/KRITIS environments with Java-based operational technology frontends or customer portals — should treat this as critical regardless of the absence of a CISA-confirmed ransomware campaign flag.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Upgrade to Apache Tomcat 9.0.1+, 8.5.23+, 8.0.47+, or 7.0.82+ — packages are available from the Apache project; confirm exact build in the official Apache Tomcat Security Advisory.
  • Disable HTTP PUT on the DefaultServlet: In web.xml, set the readonly init-parameter to true (the default) or remove it entirely; restart the Tomcat service to apply the change.
  • Inventory all Tomcat instances: Cross-reference CMDB records with an active scan (Nmap on TCP 8080, 8443, 80, 443) to identify every Tomcat deployment, including instances sitting behind reverse proxies that may be forwarding PUT requests.
  • Hunt for already-uploaded webshells: Inspect all webapps/ directories for unexpected .jsp or .jspx files; compare file timestamps against the last known deployment event.
  • Block PUT at the perimeter: Until patching is complete, drop inbound HTTP PUT requests to Tomcat ports (8080, 8443) at the firewall or load balancer where PUT is not operationally required.

Runbook · Step 2

Mitigation layers

  • WAF/reverse-proxy rule: Block the PUT method for any URI ending in .jsp or .jspx; Nginx example: if ($request_method = PUT) { return 405; }; ModSecurity equivalent: SecRule REQUEST_METHOD "PUT" "id:9001,deny,status:405".
  • Network segmentation: Place Tomcat instances in dedicated server VLANs; block direct internet access to management ports (8080, 8443); expose services exclusively through a hardened DMZ reverse proxy.
  • DefaultServlet hardening: Verify that $CATALINA_HOME/conf/web.xml contains <init-param><param-name>readonly</param-name><param-value>true</param-value></init-param>; enforce this as a mandatory check in all deployment pipelines and infrastructure-as-code templates.
  • Least-privilege process account: Run the Tomcat service under a dedicated, non-privileged OS account; restrict write permissions on webapps/ to the deployment pipeline only — the Tomcat runtime process itself should not require write access to its own webroot.
  • IPS signature: Enable a Suricata/Snort rule targeting PUT requests with JSP paths; example pattern: alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg:"CVE-2017-12617 Tomcat JSP Upload"; content:"PUT"; http_method; content:".jsp"; http_uri; sid:9001617; rev:1;).

Runbook · Step 3

Detection rules

  • Web-server access logs: PUT requests to .jsp or .jspx resources returning HTTP 201 or 204 — SPL: index=weblogs method=PUT uri="*.jsp*" (status=201 OR status=204).
  • Filesystem monitoring (auditd / Sysmon): New .jsp files created inside a webapps/ directory outside of a scheduled deployment window — Sysmon EID 11 (FileCreate) where TargetFilename contains webapps and ends with .jsp.
  • Process ancestry (EDR): Tomcat JVM process (java.exe / java) spawning unexpected child processes such as cmd.exe, sh, bash, or powershell — Sigma shape: ParentImage|endswith: 'java.exe' AND Image|endswith: 'cmd.exe'.
  • Network telemetry (Zeek / Suricata): HTTP PUT to a Tomcat port followed within 60 seconds by a GET to the same URI from any source — indicates upload-then-execute pattern; correlate in Zeek HTTP log on matching uri field.
  • SIEM correlation: Three or more PUT requests to distinct JSP paths from the same source IP within five minutes — KQL: method:"PUT" AND uri:".jsp" | stats count by src_ip | where count > 3.

Metrics

Severity
critical
Priority score
200.49
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.1
Source: nvd-v3
CVSS v3
8.1
CVSS v4
—
EPSS percentile
100.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
100.0 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2017-10-03 15:00 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CPE Deprecation Remap2026-08-25 16:28 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:* → OR *cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*
  2. CPE Deprecation Remap2026-08-25 16:28 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:oracle:agile_plm:9.3.4:*:*:*:*:*:*:* → OR *cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.4:*:*:*:*:*:*:*
  3. CPE Deprecation Remap2026-08-25 16:28 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:* → OR *cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*
  4. CPE Deprecation Remap2026-08-25 16:28 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:* → OR *cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*

Affected operating systems

  • linux

    debian / debian_linux7.0

  • linux

    redhat / enterprise_linux_desktop6.0

  • linux

    redhat / enterprise_linux_desktop7.0

  • linux

    redhat / enterprise_linux_eus7.4

  • linux

    redhat / enterprise_linux_eus7.5

  • linux

    redhat / enterprise_linux_eus7.6

  • linux

    redhat / enterprise_linux_eus7.7

  • linux

    redhat / enterprise_linux_eus_compute_node7.4

  • linux

    redhat / enterprise_linux_eus_compute_node7.5

  • linux

    redhat / enterprise_linux_eus_compute_node7.6

  • linux

    redhat / enterprise_linux_eus_compute_node7.7

  • linux

    redhat / enterprise_linux_for_ibm_z_systems6.0_s390x

  • linux

    redhat / enterprise_linux_for_ibm_z_systems7.0_s390x

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_eus7.4_s390x

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_eus7.5_s390x

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_eus7.6_s390x

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_eus7.7_s390x

  • linux

    redhat / enterprise_linux_for_power_big_endian6.0_ppc64

  • linux

    redhat / enterprise_linux_for_power_big_endian7.0_ppc64

  • linux

    redhat / enterprise_linux_for_power_big_endian_eus7.4_ppc64

  • linux

    redhat / enterprise_linux_for_power_big_endian_eus7.5_ppc64

  • linux

    redhat / enterprise_linux_for_power_big_endian_eus7.6_ppc64

  • linux

    redhat / enterprise_linux_for_power_big_endian_eus7.7_ppc64

  • linux

    redhat / enterprise_linux_for_power_little_endian7.0

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apache

    tomcat7.0.0 – 7.0.82

  • apache

    tomcat8.0 – 8.0.47

  • apache

    tomcat8.5.0 – 8.5.23

  • apache

    tomcat9.0.0 – 9.0.1

  • netapp

    active_iq_unified_manager7.3

  • netapp

    active_iq_unified_manager9.5

  • netapp

    oncommand_balance

  • netapp

    oncommand_insight

  • netapp

    oncommand_shift

  • netapp

    oncommand_workflow_automation

  • netapp

    snapcenter

  • oracle

    agile_product_lifecycle_management

  • oracle

    communications_instant_messaging_server

  • oracle

    endeca_information_discovery_integrator

  • oracle

    enterprise_manager_for_mysql_database

  • oracle

    financial_services_analytical_applications_infrastructure7.3.3.0.0 – 7.3.5.3.0

  • oracle

    financial_services_analytical_applications_infrastructure8.0.0.0.0 – 8.0.9.0.0

  • oracle

    fmw_platform

  • oracle

    health_sciences_empirica_inspections

  • oracle

    hospitality_guest_access

  • oracle

    instantis_enterprisetrack

  • oracle

    management_pack

  • oracle

    micros_lucas

  • oracle

    micros_retail_xbri_loss_prevention

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2017-12617