Apache Tomcat 8

Tenable plugin 103697 maps to CVE-2017-12617 in Apache Tomcat. On the 8.0 branch, versions 8.0.0.RC1 through 8.0.46 are affected and fixed in 8.0.47; Apache also lists affected ranges on other branches as 7.0.0–7.0.81, 8.5.0–8.5.22, and 9.0.0.M1–9.0.0. The bug allows an unauthenticated remote attacker to upload a JSP via HTTP PUT, then request it back for server-side execution, but only when the target servlet context allows writes such as readonly=false on the Default servlet and PUT is reachable.

The raw technical impact is real RCE, so Apache/NVD calling it HIGH is reasonable for an actually exposed host. But for enterprise patch prioritization, a version-only finding materially overstates fleet risk because the exploit chain depends on a non-default, deployment-specific configuration gate; most stock Tomcat installs are not writable this way. That makes this a downgrade to MEDIUM for broad patch scheduling, while still treating confirmed exposed internet-facing nodes as urgent because the CVE is KEV-listed and heavily probed.

Why this verdict

• Downgrade for config friction: vendor/NVD start at 8.1 HIGH, but the exploit requires PUT plus a writable servlet context such as readonly=false; that sharply narrows the reachable population.
• Posture matters more than version here: a version-only Nessus hit does not prove exploitability. In modern estates, reverse proxies, WAFs, and method restrictions often stop the chain before file write.
• Not a paper tiger: KEV listing, public PoCs, and GreyNoise scanning keep this above LOW because confirmed exposed nodes are straightforward RCE opportunities for unauthenticated attackers.

Why not higher?

It is not higher because this is not universal RCE across all vulnerable versions. The attack needs a specific writable-PUT deployment state that many enterprises do not expose, and that prerequisite compounds with internet reachability requirements. In other words: strong impact, but narrower real-world blast radius than the version string suggests.

Why not lower?

It is not lower because the pre-auth path is still remote and the payoff is full server-side code execution. CISA has enough exploitation evidence to KEV-list it, and public PoCs mean defenders should assume commodity scanning will continue to find the few misconfigured servers that remain.

1. Block HTTP PUT to Tomcat content paths — Enforce this at the reverse proxy, WAF, load balancer, or connector layer and deploy immediately, within hours because the CVE is KEV-listed. If your application truly needs PUT, scope it to explicit authenticated endpoints rather than broad static or default servlet paths.
2. Verify readonly=true for DefaultServlet — Audit conf/web.xml, application WEB-INF/web.xml, and any context overrides so writable static content is not enabled unintentionally. Do this immediately, within hours on internet-facing and DMZ Tomcat first.
3. Constrain internet exposure — Move non-public Tomcat instances behind VPN, private ingress, or application gateways and limit direct access to only necessary paths. Apply this immediately, within hours for externally reachable systems while remediation is queued.
4. Hunt for suspicious JSP drops — Search web roots and deployment directories for newly created .jsp or .jspx files, then correlate with PUT requests in access logs. Start this immediately, within hours because compromise artifacts can persist even after config changes.

Run this on the target Tomcat host as a local auditor or via SSH. Invoke it as bash tomcat_cve_2017_12617_check.sh /opt/tomcat or point it at CATALINA_BASE; no root is required unless Tomcat config files are restricted. The script checks whether the installed 8.0.x version is below 8.0.47 and then looks for obvious readonly=false servlet settings; because app-specific overrides can hide elsewhere, a clean result on config returns UNKNOWN, not false reassurance.

#!/usr/bin/env bash
# tomcat_cve_2017_12617_check.sh
# Check Apache Tomcat 8.0.x for CVE-2017-12617 exposure indicators.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

TARGET="${1:-${CATALINA_BASE:-}}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN - provide CATALINA_BASE/TOMCAT_HOME as argument, e.g. bash $0 /opt/tomcat"
  exit 2
fi

if [[ ! -d "$TARGET" ]]; then
  echo "UNKNOWN - target path not found: $TARGET"
  exit 2
fi

version=""
for f in \
  "$TARGET/RELEASE-NOTES" \
  "$TARGET/RUNNING.txt" \
  "$TARGET/lib/catalina.jar"; do
  if [[ -f "$f" ]]; then
    if [[ "$f" == *.jar ]]; then
      if command -v unzip >/dev/null 2>&1; then
        v=$(unzip -p "$f" org/apache/catalina/util/ServerInfo.properties 2>/dev/null | awk -F= '/server.info=Apache Tomcat\//{print $2}' | sed 's/Apache Tomcat\///')
        [[ -n "$v" ]] && version="$v" && break
      fi
    else
      v=$(grep -Eo 'Apache Tomcat Version [0-9]+\.[0-9]+\.[A-Za-z0-9.-]+' "$f" 2>/dev/null | head -n1 | awk '{print $4}')
      [[ -n "$v" ]] && version="$v" && break
      v=$(grep -Eo 'Apache Tomcat/[0-9]+\.[0-9]+\.[A-Za-z0-9.-]+' "$f" 2>/dev/null | head -n1 | cut -d/ -f2)
      [[ -n "$v" ]] && version="$v" && break
    fi
  fi
done

if [[ -z "$version" ]]; then
  echo "UNKNOWN - could not determine Tomcat version under $TARGET"
  exit 2
fi

# Normalize versions like 8.0.46, 8.0.0.RC1 not handled numerically.
# This plugin is specifically for 8.0.0.RC1 < 8.0.47.
if [[ ! "$version" =~ ^8\.0\. ]]; then
  echo "UNKNOWN - detected version $version, but this check is scoped to Tomcat 8.0.x"
  exit 2
fi

is_vuln_version=1
if [[ "$version" =~ ^8\.0\.([0-9]+)$ ]]; then
  patch="${BASH_REMATCH[1]}"
  if (( patch >= 47 )); then
    is_vuln_version=0
  fi
else
  # Covers pre-release strings like 8.0.0.RC1 as vulnerable to this plugin range.
  is_vuln_version=1
fi

if (( is_vuln_version == 0 )); then
  echo "PATCHED - Tomcat version $version is not in the affected 8.0.x range before 8.0.47"
  exit 0
fi

found_cfg=0
found_readonly_false=0

declare -a files
files=(
  "$TARGET/conf/web.xml"
)

while IFS= read -r -d '' file; do
  files+=("$file")
done < <(find "$TARGET" -type f \( -path '*/WEB-INF/web.xml' -o -name 'web.xml' -o -name 'context.xml' \) -print0 2>/dev/null)

for file in "${files[@]}"; do
  [[ -f "$file" ]] || continue
  found_cfg=1
  if grep -Eiq '(<param-name>\s*readonly\s*</param-name>.*<param-value>\s*false\s*</param-value>)|(<param-value>\s*false\s*</param-value>.*<param-name>\s*readonly\s*</param-name>)|readonly\s*=\s*false' "$file"; then
    echo "VULNERABLE - Tomcat $version and writable servlet setting detected in $file"
    found_readonly_false=1
    exit 1
  fi
done

if (( found_cfg == 0 )); then
  echo "UNKNOWN - Tomcat $version found, but no config files were readable to confirm writable PUT exposure"
  exit 2
fi

echo "UNKNOWN - Tomcat $version is in the affected version range, but no obvious readonly=false setting was found. Version-only scanners may overstate risk; manually verify PUT reachability and per-app overrides."
exit 2

Sources

1. Tenable Nessus Plugin 103697
2. Apache Tomcat 8 security page
3. NVD CVE-2017-12617
4. CISA Known Exploited Vulnerabilities entry
5. GreyNoise scanning activity
6. Debian security tracker
7. Ubuntu CVE page
8. Exploit-DB 42966