{"id":"CVE-2017-12617","kind":"vulnerability","aliases":["CVE-2017-12617"],"related":[],"title":"Apache Tomcat: Apache Tomcat Remote Code Execution Vulnerability","description":"When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","summary":"Tomcat's Default servlet (or WebDAV servlet) can be made to accept a crafted HTTP PUT that uploads a JSP, which the attacker then requests to run code as the Tomcat process. It only works when the servlet is configured with readonly=false and untrusted users can send PUT. A default install is not affected. Exploit code is public and the CVE is in CISA KEV.","severity":"critical","cvss":8.1,"epss":0.99968,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Apache Tomcat","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Apache Tomcat 9","fixed":["9.0.1"],"affected":">= 9.0.0.M1, <= 9.0.0","ecosystem":"vendor"},{"name":"Apache Tomcat 8.5","fixed":["8.5.23"],"affected":">= 8.5.0, <= 8.5.22","ecosystem":"vendor"},{"name":"Apache Tomcat 8.0","fixed":["8.0.47"],"affected":">= 8.0.0.RC1, <= 8.0.46","ecosystem":"vendor"},{"name":"Apache Tomcat 7","fixed":["7.0.82"],"affected":">= 7.0.0, <= 7.0.81","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","file-upload","java","rce","runtime","self-hosted","tomcat"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"1. Find the version: run version.sh (or catalina.sh version) and look for 9.0.0.M1-9.0.0, 8.5.0-8.5.22, 8.0.0.RC1-8.0.46 or 7.0.0-7.0.81. 2. Check exposure: in conf/web.xml and each webapp's WEB-INF/web.xml, look at the Default servlet (and any WebDAV servlet) for an init-param readonly set to false. If readonly is absent or true, you are not exposed. 3. Also check whether a reverse proxy or security constraint already blocks PUT/DELETE/MOVE/COPY from untrusted users.","fix":"Upgrade to Tomcat 9.0.1 or later, 8.5.23 or later, 8.0.47 or later, or 7.0.82 or later. Note that 7.0.x, 8.0.x and 8.5.x are now end of life, so move to a supported 9.0.x or later. Until then, set readonly to true on the Default and WebDAV servlets, or block HTTP methods that modify resources for untrusted users.","status":"open","published_at":"2017-10-04T01:29:02+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:00+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.93,"triage":{"at":"2026-10-23T21:22:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Tomcat to a fixed release per vendor instructions; the sources do not name the fixed version.\nunknown","reach":"internet","impact":"high","summary":"Apache Tomcat accepts a crafted HTTP PUT that uploads a JSP file to the server, and the attacker then requests that file so its code runs on the server. An unauthenticated remote attacker gets code execution as the Tomcat process.","category":"runtime","who_cares":["tomcat","java","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker uploads a JSP and runs arbitrary code on the server.","analyst_note":"Sources do not give affected or fixed versions or the special setting; check the Apache Tomcat security page for CVE-2017-12617 for the affected version range and the write-enabled default setting.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000466,"input_tokens":2836,"output_tokens":365,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Sources do not give affected or fixed versions or the special setting; check the Apache Tomcat security page for CVE-2017-12617 for the affected version range and the write-enabled default setting.","search":"'-12617':11A,14A '-2017':10A,13A '7':28A '7.0.0':123C '7.0.81':125C '8.0':25A '8.0.0':118C '8.0.46':121C '8.5':22A '8.5.0':115C '8.5.22':117C '9':19A '9.0.0':111C,114C 'accept':51B 'affect':94B 'apach':1A,3A,108C 'apache':15A,17A,20A,23A,26A 'attack':62B 'cisa':104B 'code':6A,67B,96B,167C 'configur':79B 'contain':169C 'could':161C 'craft':53B,157C 'cve':9A,12A,101B 'default':42B,90B,139C 'e.g':130C 'enabl':129C 'execut':7A,172C 'exploit':29B,95B 'fals':82B,142C 'file':31B,150C 'file-upload':30B 'host':38B 'http':54B,127C 'initialis':135C 'instal':91B 'java':33B 'jsp':59B,149C,160C 'kev':105B 'm1':112C 'made':49B 'paramet':136C 'possibl':145C 'process':71B 'public':98B 'put':55B,88B,128C 'rc1':119C 'rce':34B 'readon':81B,134C 'remot':5A 'request':64B,158C,164C 'run':66B,107C 'runtim':35B 'self':37B 'self-host':36B 'send':87B 'server':153C,175C 'servlet':43B,46B,77B,140C 'set':132C 'special':156C 'tomcat':2A,4A,16A,18A,21A,24A,27A,39B,40B,70B,109C 'untrust':84B 'upload':32B,57B,147C 'user':85B 'version':110C 'via':131C,154C 'vulner':8A 'webdav':45B 'work':74B 'would':170C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-10-04T01:29:02+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":2,"sources":[{"source":"kev","external_id":"CVE-2017-12617","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12617","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2017-12617","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12617","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2017-12617:76","url":null,"severity":null,"published_at":"2026-10-23T21:25:53+00:00","modified_at":"2026-10-23T21:25:53+00:00","first_seen_at":"2026-10-23T21:25:53+00:00","fetched_at":"2026-10-23T21:25:53+00:00","note":"Read Apache's advisory (lists.apache.org) and the Tomcat 7/8/9 security pages. Affected and fixed versions confirmed; only exposed when the Default servlet has readonly=false, so default installs are not affected. Public PoCs: Exploit-DB 42966 and Metasploit. KEV-listed and exploited."},{"source":"nvd","external_id":"CVE-2017-12617","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12617","severity":null,"published_at":"2017-10-04T01:29:02+00:00","modified_at":"2026-08-25T16:28:27+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":1006,"url":"https://lists.apache.org/thread/bgsk95kmrdphzo9f32zvnz4vkqvwor3h","title":"[SECURITY] CVE-2017-12617 Apache Tomcat RCE via JSP upload","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1007,"url":"https://tomcat.apache.org/security-9.html","title":"Apache Tomcat 9 security page","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1008,"url":"https://www.mail-archive.com/users@tomcat.apache.org/msg127177.html","title":"Mark Thomas: CVE-2017-12617 investigation updates and mitigations","kind":"post","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1009,"url":"https://www.exploit-db.com/exploits/42966","title":"Exploit-DB 42966 Tomcat JSP upload bypass","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1010,"url":"https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/multi/http/tomcat_jsp_upload_bypass.md","title":"Metasploit tomcat_jsp_upload_bypass","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}