Apache Tomcat 7

Tenable plugin 102587 maps to CVE-2017-7674, a Tomcat CORS filter bug fixed in Apache Tomcat 7.0.79. Affected Tomcat 7 versions are 7.0.41 through 7.0.78. The flaw is simple: Tomcat's CorsFilter failed to add a Vary: Origin header, so caches could incorrectly reuse a response generated for one Origin when serving another, enabling *client-side or shared-cache poisoning in some circumstances*.

The vendor's MEDIUM label is technically defensible but operationally still a bit high for most enterprises. This is not pre-auth RCE, not auth bypass, and not a broad server compromise path; exploitation usually requires the app to actually use Tomcat's CorsFilter, to emit cacheable origin-sensitive responses, and to sit behind a browser or intermediary cache that replays the wrong object. In real fleets, those stacked prerequisites crush exposure, so this lands LOW unless you knowingly run cacheable cross-origin APIs behind shared caches or CDNs.

Why this verdict

• Requires more than a version: Tomcat 7.0.41-7.0.78 alone is insufficient; the app must actively use org.apache.catalina.filters.CorsFilter.
• Cache behavior is the real gate: no reusable browser/proxy/CDN cache path, no meaningful exploit chain.
• Impact is narrow by design: upstream/NVD land on low integrity impact with no confidentiality or availability loss, which matches the likely blast radius.
• No field pressure: no KEV entry, no strong public in-the-wild reporting, and no common offensive tooling adoption surfaced.
• Version scanner inflation: Tenable flags binary version, not the presence of origin-sensitive cacheable endpoints, so the reported population will be larger than the truly exploitable population.

Why not higher?

This is not a generic internet RCE, auth bypass, or file-read bug. The chain needs stacked prerequisites: vulnerable Tomcat version, live CorsFilter usage, cacheable origin-varying responses, and a victim or shared cache path that actually reuses the poisoned object. Those are meaningful compounding friction points.

Why not lower?

It is still a real upstream security issue with a published CVE, fix, and plausible abuse path in environments using cross-origin APIs behind shared caches. If you run origin-sensitive APIs through CDNs or reverse proxies and rely on CORS behavior for correctness, the bug can move from theoretical to practical fast enough that IGNORE would be sloppy.

1. Disable caching on CORS-sensitive responses — Set Cache-Control: no-store or at minimum private on origin-sensitive API responses so the poisonable object never becomes reusable. For a LOW verdict there is no formal mitigation SLA, but if you cannot patch soon and you know these endpoints exist, apply this as backlog hygiene while you work the patch.
2. Add Vary: Origin at the edge — If you terminate traffic at NGINX, Apache httpd, a load balancer, API gateway, or CDN, inject Vary: Origin on affected responses there. That breaks the cache-confusion condition even before the Tomcat upgrade; for LOW, do it opportunistically where cross-origin APIs are business-critical.
3. Inventory actual CorsFilter usage — Search deployed web.xml files and app configs for org.apache.catalina.filters.CorsFilter so you can separate theoretical version hits from real exposure. This should be done during normal backlog cleanup because the reassessed severity does not justify an emergency response.
4. Prefer non-cacheable auth/API paths at the CDN — Explicitly bypass caching for authenticated or origin-sensitive API routes in CDNs and reverse proxies. This hardens the environment regardless of Tomcat version and is especially useful if Tomcat 7 is embedded in vendor appliances you cannot patch quickly.

Run this on the target Tomcat host as a local shell user with read access to the Tomcat install and deployed app configs; root is not strictly required unless permissions are locked down. Invoke it as bash verify_tomcat_cve_2017_7674.sh /opt/tomcat or omit the argument to auto-check common paths; it reports VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# verify_tomcat_cve_2017_7674.sh
# Checks Apache Tomcat 7 for CVE-2017-7674 exposure conditions.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_PATH="${1:-}"

find_tomcat_home() {
  if [[ -n "$TARGET_PATH" && -d "$TARGET_PATH" ]]; then
    echo "$TARGET_PATH"
    return 0
  fi

  local candidates=(
    "$CATALINA_HOME"
    "$CATALINA_BASE"
    /opt/tomcat
    /usr/share/tomcat7
    /var/lib/tomcat7
    /usr/local/tomcat
    /opt/apache-tomcat-7*
  )

  local c
  for c in "${candidates[@]}"; do
    [[ -n "${c:-}" ]] || continue
    for expanded in $c; do
      if [[ -d "$expanded" && ( -f "$expanded/lib/catalina.jar" || -f "$expanded/bin/version.sh" ) ]]; then
        echo "$expanded"
        return 0
      fi
    done
  done
  return 1
}

extract_version() {
  local home="$1"
  local version=""

  if [[ -f "$home/RELEASE-NOTES" ]]; then
    version=$(grep -Eo 'Apache Tomcat Version [0-9]+\.[0-9]+\.[0-9]+' "$home/RELEASE-NOTES" 2>/dev/null | head -n1 | awk '{print $4}')
  fi

  if [[ -z "$version" && -f "$home/bin/version.sh" ]]; then
    version=$(grep -Eo 'Server version: Apache Tomcat/[0-9]+\.[0-9]+\.[0-9]+' "$home/bin/version.sh" 2>/dev/null | head -n1 | cut -d/ -f2)
  fi

  if [[ -z "$version" && -f "$home/lib/catalina.jar" && -x "$(command -v unzip)" ]]; then
    version=$(unzip -p "$home/lib/catalina.jar" META-INF/MANIFEST.MF 2>/dev/null | awk -F': ' '/Implementation-Version/ {print $2; exit}' | tr -d '\r')
  fi

  echo "$version"
}

ver_to_int() {
  local IFS=.
  local a b c
  read -r a b c <<< "$1"
  a=${a:-0}; b=${b:-0}; c=${c:-0}
  printf '%03d%03d%03d\n' "$a" "$b" "$c"
}

is_vulnerable_version() {
  local v="$1"
  [[ "$v" =~ ^7\.[0-9]+\.[0-9]+$ ]] || return 1
  local vi
  vi=$(ver_to_int "$v")
  local low high
  low=$(ver_to_int "7.0.41")
  high=$(ver_to_int "7.0.79")
  [[ "$vi" -ge "$low" && "$vi" -lt "$high" ]]
}

check_cors_filter_usage() {
  local home="$1"
  local found=1
  local paths=(
    "$home/conf/web.xml"
    "$home/webapps"
    "$home/conf/Catalina"
  )

  local p
  for p in "${paths[@]}"; do
    [[ -e "$p" ]] || continue
    if grep -RIsq 'org\.apache\.catalina\.filters\.CorsFilter\|<filter-class>.*CorsFilter</filter-class>' "$p" 2>/dev/null; then
      found=0
      break
    fi
  done
  return $found
}

HOME_DIR=$(find_tomcat_home) || {
  echo "UNKNOWN - could not locate Tomcat home"
  exit 2
}

VERSION=$(extract_version "$HOME_DIR")
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - could not determine Tomcat version under $HOME_DIR"
  exit 2
fi

if ! [[ "$VERSION" =~ ^7\.[0-9]+\.[0-9]+$ ]]; then
  echo "PATCHED - Tomcat version $VERSION is outside the Tomcat 7 vulnerable range checked by this script"
  exit 0
fi

if is_vulnerable_version "$VERSION"; then
  if check_cors_filter_usage "$HOME_DIR"; then
    echo "VULNERABLE - Tomcat $VERSION with CorsFilter usage detected under $HOME_DIR"
    exit 1
  else
    echo "PATCHED - Tomcat $VERSION is in the affected version band, but no CorsFilter usage was detected; CVE-2017-7674 path not evidenced"
    exit 0
  fi
else
  echo "PATCHED - Tomcat version $VERSION is not in 7.0.41-7.0.78"
  exit 0
fi

Sources

1. Tenable plugin 102587
2. Apache Tomcat 7 security page
3. NVD CVE-2017-7674
4. Ubuntu CVE-2017-7674 advisory
5. Debian security tracker CVE-2017-7674
6. FIRST EPSS API documentation
7. CISA Known Exploited Vulnerabilities Catalog
8. GitLab advisory for CVE-2017-7674