# MA-684.102017: MyCERT Advisory - Apache Tomcat Remote Code Execution via JSP upload

**Date:** 05 Oct 2017  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-684.102017  
**Advisory ID:** MA-684.102017

---

**1.0    Introduction**
A new vulnerability found in Apache Tomcat version below 9.0.1 and 8.5.23 with HTTP PUT enabled allow uploading a JSP file to the server via a specially crafted request when running HTTP PUTs enabled (e.g. via setting the read only initialization parameter of the Default servlet to false). This JSP could then be requested and any code it contained would be executed by the server.
**2.0    Impact**
Exploitation of this vulnerability may allow an attacker to take control of an affected server.
**3.0 Affected Products**
The affected products of Apache Tomcat are as listed below:
- Apache Tomcat 9.0.0.M1 to 9.0.0
- Apache Tomcat 8.5.0 to 8.5.22
- Apache Tomcat 8.0.0.RC1 to 8.0.46
- Apache Tomcat 7.0.0 to 7.0.81
**4.0 Recommendations**
MyCERT recommends all users of the affected versions should apply one of the following mitigations:
- Upgrade to Apache Tomcat 9.0.1 or later
- Upgrade to Apache Tomcat 8.5.23 or later
- Upgrade to Apache Tomcat 8.0.47 or later
- Upgrade to Apache Tomcat 7.0.82 or later
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#89eaf0ebecfbb0b0b0c9eaf0ebecfbfaeceafcfbe0fdf0a7e4f0) or [[email protected]](/cdn-cgi/l/email-protection#2d40544e485f596d40544e485f5903425f4a034054)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0    References**
- <https://access.redhat.com/security/cve/cve-2017-12617>
- <https://www.exploit-db.com/exploits/42953/>
- <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12617>
- <https:/www.us-cert.gov/ncas/current-activity/2017/10/03/Apache-Releases-Security-Updates-Apache-Tomcat>
- <http://tomcat.apache.org/security-9.html>
- <http://tomcat.apache.org/security-8.html>
- <http://tomcat.apache.org/security-7.html>