Apache Tomcat 7

Tenable plugin 103329 flags any Apache Tomcat 7.0.0 through <7.0.81, but the real exposure is split across two very different flaws. CVE-2017-12615 is the serious one: unauthenticated remote JSP upload leading to RCE, but only on Windows and only when HTTP PUT is enabled, typically by setting the Default servlet readonly init-param to false; upstream says it affects 7.0.0 to 7.0.79. CVE-2017-12616 affects 7.0.0 to 7.0.80 and allows security-constraint bypass and JSP source disclosure, but only when VirtualDirContext is in use.

The vendor/plugin High label is fair for a host that actually meets those prerequisites, but it overstates risk for a generic fleet ticket because the plugin is a version-only check and does not prove Windows, PUT enablement, or VirtualDirContext. In a 10,000-host estate, those conditions are exactly the kind of friction that should drag a blanket patch finding down from panic status to scoped validation—while still treating confirmed Windows+PUT instances as urgent because CVE-2017-12615 is KEV-listed and has public exploit code.

Why this verdict

• Downward pressure: Windows-only RCE path — CVE-2017-12615 is not a universal Tomcat 7 RCE; it only applies to Windows for the version range Apache lists.
• Downward pressure: dangerous PUT config required — the attacker still needs HTTP PUT enabled, usually via readonly=false, which is not the normal secure deployment state and materially shrinks the reachable population.
• Downward pressure: alternate flaw is app-specific — CVE-2017-12616 needs VirtualDirContext, so many plugin hits on Linux/standard server builds collapse to non-exploitable noise.
• Upward pressure: real exploitation evidence exists — CVE-2017-12615 is in CISA KEV and public exploit code is easy to obtain, so any host that actually satisfies the prerequisites is high-priority in practice.
• Downward pressure: scanner certainty is low — Tenable explicitly says it did not test the issues and relied on self-reported versioning, which is a bad basis for fleet-wide urgency.

Why not higher?

It is not HIGH or CRITICAL as a blanket estate verdict because the exploit chain assumes a configuration that many enterprises simply do not expose: Windows Tomcat with PUT enabled, or separately VirtualDirContext. That is compounding friction, not edge-case trivia. A 10,000-host patch program should score the reachable population, not the theoretical maximum damage of the best-case lab exploit.

Why not lower?

It is not LOW or IGNORE because one branch is still unauthenticated remote code execution with public PoCs and confirmed exploitation history via KEV. If you do have Windows Tomcat with PUT enabled, this finding stops being noisy instantly and becomes a very real shell-on-server problem.

1. Disable PUT on DefaultServlet — For any unpatched Tomcat 7 on Windows, verify the Default servlet readonly init-param is not false and block HTTP PUT at the app server and reverse proxy. Because CVE-2017-12615 is KEV-listed, deploy this immediately, within hours for any system you cannot patch today.
2. Block dangerous methods upstream — Enforce GET/POST/HEAD only at the WAF, load balancer, or reverse proxy unless a business case explicitly requires other verbs. This is the fastest blast-radius reduction and, due to KEV status, should be in place immediately, within hours for exposed legacy Tomcat.
3. Hunt for VirtualDirContext — Search server.xml, context.xml, and app context fragments for VirtualDirContext; if present on affected versions, treat the host as exposed to CVE-2017-12616 and remove that dependency or isolate the app. Because there is active relevance in the plugin bundle, complete this validation immediately, within hours on internet-facing or high-value internal apps.
4. Constrain Tomcat service privileges — Run Tomcat with a least-privilege service account, deny interactive logon, and restrict write/execute paths so a JSP upload cannot trivially become host takeover. This does not fix the bug, but it cuts post-exploitation blast radius and should be enforced immediately, within hours on any confirmed exposed instance.
5. Alert on JSP upload-and-fetch patterns — Detect PUT or MOVE to .jsp, .jspx, or suspicious content types followed by a request to the same path, and alert on child processes launched by java/Tomcat. Stand this up immediately, within hours where patching will lag.

Run this on the target Tomcat host or against an offline copy of its installation directory. Invoke it as python3 tomcat_103329_check.py /opt/tomcat or py tomcat_103329_check.py "C:\Tomcat7"; it only needs read access to the Tomcat install and conf/ files, not admin rights.

#!/usr/bin/env python3
# tomcat_103329_check.py
# Checks likely exploitability for Tenable plugin 103329 on a local Tomcat install.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE/ERROR

import os
import re
import sys
from pathlib import Path


def read_text(path):
    try:
        return Path(path).read_text(encoding='utf-8', errors='ignore')
    except Exception:
        return None


def parse_version(text):
    if not text:
        return None
    patterns = [
        r'Apache Tomcat Version\s+([0-9]+\.[0-9]+\.[0-9]+)',
        r'Server version:\s*Apache Tomcat/([0-9]+\.[0-9]+\.[0-9]+)',
        r'Implementation-Version:\s*([0-9]+\.[0-9]+\.[0-9]+)',
        r'Specification-Version:\s*([0-9]+\.[0-9]+\.[0-9]+)'
    ]
    for pat in patterns:
        m = re.search(pat, text, re.IGNORECASE)
        if m:
            return m.group(1)
    return None


def version_tuple(v):
    try:
        return tuple(int(x) for x in v.split('.'))
    except Exception:
        return None


def find_version(base):
    candidates = [
        base / 'RELEASE-NOTES',
        base / 'RUNNING.txt',
        base / 'bin' / 'version.sh',
        base / 'bin' / 'version.bat',
        base / 'lib' / 'catalina.jar',
        base / 'lib' / 'catalina.jar.MF',
        base / 'lib' / 'MANIFEST.MF'
    ]

    for c in candidates:
        if c.is_file():
            txt = read_text(c)
            v = parse_version(txt)
            if v:
                return v, str(c)

    # Fallback: search a few likely text files under base
    for rel in ['RELEASE-NOTES', 'RUNNING.txt']:
        p = base / rel
        if p.exists():
            txt = read_text(p)
            v = parse_version(txt)
            if v:
                return v, str(p)

    return None, None


def is_put_enabled(base):
    webxml = base / 'conf' / 'web.xml'
    txt = read_text(webxml)
    if not txt:
        return None, str(webxml)

    # Conservative check: look for readonly=false anywhere in web.xml
    if re.search(r'<param-name>\s*readonly\s*</param-name>\s*<param-value>\s*false\s*</param-value>', txt, re.IGNORECASE | re.DOTALL):
        return True, str(webxml)

    # If readonly parameter is absent or not false, assume PUT is not enabled on default servlet.
    return False, str(webxml)


def has_virtualdircontext(base):
    conf_dir = base / 'conf'
    if not conf_dir.exists():
        return None, str(conf_dir)

    checked = []
    for p in conf_dir.rglob('*.xml'):
        checked.append(str(p))
        txt = read_text(p)
        if txt and 'VirtualDirContext' in txt:
            return True, ', '.join(checked)
    return False, ', '.join(checked)


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 tomcat_103329_check.py <CATALINA_BASE>')
        sys.exit(3)

    base = Path(sys.argv[1])
    if not base.exists() or not base.is_dir():
        print('UNKNOWN - path does not exist or is not a directory')
        sys.exit(3)

    version, source = find_version(base)
    if not version:
        print('UNKNOWN - could not determine Tomcat version from local files')
        sys.exit(2)

    vt = version_tuple(version)
    if not vt:
        print(f'UNKNOWN - unparsable Tomcat version: {version}')
        sys.exit(2)

    # Upstream fixed point for the bundled Tenable finding
    if vt >= (7, 0, 81):
        print(f'PATCHED - Tomcat {version} (>= 7.0.81) from {source}')
        sys.exit(0)

    put_enabled, put_source = is_put_enabled(base)
    vdc_enabled, vdc_source = has_virtualdircontext(base)
    on_windows = (os.name == 'nt')

    reasons = []
    if vdc_enabled is True:
        reasons.append('VirtualDirContext present (CVE-2017-12616 path)')

    if on_windows and vt < (7, 0, 80) and put_enabled is True:
        reasons.append('Windows host and DefaultServlet readonly=false / PUT enabled (CVE-2017-12615 path)')

    if reasons:
        print(f'VULNERABLE - Tomcat {version}; ' + '; '.join(reasons))
        sys.exit(1)

    # Not enough evidence for exploitability even though version is old.
    detail = []
    detail.append(f'Tomcat {version} < 7.0.81')
    detail.append(f'OS={"Windows" if on_windows else "Non-Windows"}')
    detail.append(f'PUT enabled={put_enabled} ({put_source})')
    detail.append(f'VirtualDirContext present={vdc_enabled} ({vdc_source})')
    print('UNKNOWN - affected version detected but required exploit conditions were not confirmed: ' + '; '.join(detail))
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Tenable plugin 103329
2. Apache Tomcat 7 security page
3. CVE.org record for CVE-2017-12615
4. NVD entry for CVE-2017-12615
5. CISA Known Exploited Vulnerabilities Catalog
6. CISA 2017 Tomcat alert
7. Ubuntu CVE-2017-12616 status/backports
8. FIRST EPSS API documentation