CVE-2017-12615 in Tomcat
Summary
by MITRE
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability represents a critical remote code execution flaw in Apache Tomcat versions 7.0.0 through 7.0.79 when deployed on Windows systems with HTTP PUT operations enabled. The vulnerability stems from improper input validation and access control mechanisms within the web server's file upload handling capabilities. Attackers could exploit this weakness by crafting specially formatted HTTP PUT requests that bypass normal file upload restrictions, allowing them to deposit malicious Java Server Pages files directly onto the server filesystem. The flaw directly violates security principle of least privilege and demonstrates inadequate validation of user-supplied input, which aligns with CWE-20 - Improper Input Validation.
The technical implementation of this vulnerability occurs when the Default servlet's readonly parameter is set to false, which enables HTTP PUT operations for file uploads. Under normal circumstances, this configuration should be carefully restricted, but when improperly configured on Windows systems, it creates an attack surface where malicious actors can upload JSP files containing arbitrary code. The uploaded JSP files are then executable by the Tomcat server, effectively allowing attackers to run arbitrary commands on the target system with the privileges of the Tomcat service account. This represents a classic server-side request forgery and file inclusion vulnerability that enables full system compromise.
The operational impact of CVE-2017-12615 is severe and encompasses complete system compromise, data exfiltration, and potential lateral movement within network environments. Once successfully exploited, attackers gain the ability to execute arbitrary code, establish persistent backdoors, and potentially escalate privileges to gain administrative access to the underlying operating system. The vulnerability affects organizations running vulnerable Tomcat versions in production environments, particularly those with insufficient security configurations and monitoring capabilities. From an ATT&CK framework perspective, this vulnerability maps to T1190 - Exploit Public-Facing Application and T1059 - Command and Scripting Interpreter, demonstrating how a single configuration flaw can enable multiple attack vectors.
Mitigation strategies for this vulnerability require immediate patching of affected Tomcat installations to versions 7.0.80 or later, which contain the necessary security fixes. Organizations should also disable HTTP PUT operations by setting the readonly parameter to true in their Tomcat configurations, unless specifically required for legitimate business purposes. Additional protective measures include implementing network segmentation, deploying web application firewalls, and establishing robust monitoring for unusual file upload activities. Security hardening practices should enforce principle of least privilege for Tomcat service accounts and implement proper file system permissions to prevent unauthorized file creation and execution. Regular security assessments and vulnerability scanning should be conducted to identify and remediate similar configuration issues across the organization's infrastructure.