Apache Tomcat 8

The Tenable plugin maps to CVE-2017-5664 in Apache Tomcat's Default Servlet. Affected versions are Tomcat 8.5.0 through 8.5.14, fixed in 8.5.15. When an error occurs and Tomcat forwards the original request to a configured error page, static error pages were incorrectly handled with the original HTTP method instead of being treated like GET; that can produce unexpected behavior, and in the worst case can let an attacker overwrite or remove a static custom error page if the DefaultServlet is configured to allow writes.

On paper this scores high for integrity because it is network-reachable and unauthenticated. In real enterprise deployments, that overstates the risk. The exploit chain depends on a very specific application pattern: a request that triggers an error dispatch, a static custom error page, and usually a non-default writable DefaultServlet or similarly unsafe custom error-page logic. Most Tomcat estates do not intentionally expose writable static resources through DefaultServlet, so the vendor-style severity is too generous for Monday-morning patch triage.

Why this verdict

• Requires an error-page edge case: the attacker does not get a generic app-wide primitive; they need a request that lands in Tomcat's error-page forwarding path.
• Depends on unsafe implementation choices: practical damage usually requires a static error page plus DefaultServlet writes enabled or a custom JSP/Servlet error page that mishandles methods.
• Blast radius is narrow: even when reachable, the impact is mostly limited to tampering with error-page handling or bypassing method assumptions on that path, not arbitrary code execution or broad auth bypass.

Why not higher?

This is not a clean RCE, deserialization, traversal, or generic auth bypass. The exploit path compounds friction at every step: specific method, specific error route, specific error-page type, and often a non-default writable servlet setting. That is classic downward pressure on severity.

Why not lower?

It is still unauthenticated and remote, and the integrity impact is not imaginary. If you inherited a sloppy Tomcat deployment with writable static resources or brittle custom error-page logic, an external attacker can abuse it without credentials, so it is not something to ignore outright.

1. Keep DefaultServlet read-only — Verify readonly=true for the Default Servlet so the most concrete overwrite/delete path is shut down. For a LOW verdict there is no SLA; treat as backlog hygiene, but this is the single best hardening check.
2. Review custom error-page mappings — Find static error pages and custom JSP/Servlet error handlers, then confirm they do not perform state-changing behavior based on forwarded methods. For LOW, do this as part of normal hardening and app review rather than an emergency change.
3. Block unnecessary HTTP methods upstream — Use the reverse proxy, WAF, or load balancer to deny methods your apps do not need, especially TRACE and stray PUT/DELETE to public paths. For LOW, roll this in through standard policy maintenance.
4. Monitor webroot integrity — Place file integrity monitoring on Tomcat webapp directories so unexpected changes to static resources and error pages are caught quickly. This does not replace patching, but it narrows dwell time if a misconfigured host exists.

Run this on the target Tomcat host or from a config-management runner with filesystem access to the Tomcat install path. Invoke it as python3 check_tomcat_100681.py /opt/tomcat or point directly at catalina.jar; no admin rights are required unless directory permissions block read access.

#!/usr/bin/env python3
"""
check_tomcat_100681.py
Detects whether a Tomcat installation matches the affected range for CVE-2017-5664
as surfaced by Tenable plugin 100681 (Apache Tomcat 8.5.0 < 8.5.15).

Usage:
  python3 check_tomcat_100681.py /path/to/tomcat
  python3 check_tomcat_100681.py /path/to/tomcat/lib/catalina.jar

Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN / usage error
"""

import os
import re
import sys
import zipfile


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', s or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def read_manifest_version(jar_path):
    try:
        with zipfile.ZipFile(jar_path, 'r') as zf:
            for name in ('META-INF/MANIFEST.MF', 'meta-inf/manifest.mf'):
                if name in zf.namelist():
                    data = zf.read(name).decode('utf-8', errors='ignore')
                    for line in data.splitlines():
                        if line.lower().startswith('implementation-version:'):
                            return line.split(':', 1)[1].strip()
                        if line.lower().startswith('specification-version:'):
                            candidate = line.split(':', 1)[1].strip()
                            if candidate:
                                return candidate
    except Exception:
        return None
    return None


def locate_jar(path_arg):
    if os.path.isfile(path_arg) and path_arg.endswith('.jar'):
        return path_arg
    if os.path.isdir(path_arg):
        candidate = os.path.join(path_arg, 'lib', 'catalina.jar')
        if os.path.isfile(candidate):
            return candidate
    return None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_tomcat_100681.py /path/to/tomcat_or_catalina.jar')
        sys.exit(2)

    target = sys.argv[1]
    jar = locate_jar(target)
    if not jar:
        print('UNKNOWN - could not locate catalina.jar from input: {}'.format(target))
        sys.exit(2)

    version_str = read_manifest_version(jar)
    version = parse_version(version_str)
    if not version:
        print('UNKNOWN - could not determine Tomcat version from {}'.format(jar))
        sys.exit(2)

    affected_min = (8, 5, 0)
    fixed = (8, 5, 15)

    if affected_min <= version < fixed:
        print('VULNERABLE - Apache Tomcat {} is in affected range 8.5.0-8.5.14 for CVE-2017-5664 / Tenable 100681'.format(version_str))
        sys.exit(1)
    elif version >= fixed:
        print('PATCHED - Apache Tomcat {} is not in affected range for Tenable 100681'.format(version_str))
        sys.exit(0)
    else:
        print('PATCHED - Apache Tomcat {} is below 8.5.x affected branch for Tenable 100681'.format(version_str))
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Tenable plugin 100681
2. Apache Tomcat 8 security page
3. NVD CVE-2017-5664
4. Vulners CVE-2017-5664
5. CISA weekly bulletin mentioning CVE-2017-5664
6. CISA Known Exploited Vulnerabilities Catalog
7. Bitsight Apache Tomcat Observation Footprint