Apache Tomcat 7

Tenable plugin 103782 is fundamentally about CVE-2017-12617 on Apache Tomcat 7: if you run Tomcat 7.0.0 through 7.0.81 and a target context allows HTTP PUT with the DefaultServlet effectively set to readonly=false, an unauthenticated attacker can upload a .jsp web shell and then execute it over HTTP. Impact is full remote code execution in the Tomcat process, not a harmless file-write.

If your source system called this MEDIUM, that undershoots reality. The vendor/NVD baseline is 8.1 High, and CISA later put it in KEV based on real-world exploitation. That said, it is not a blanket internet-breaker: the exploit depends on a non-default, operator-created condition—PUT/writeable JSP upload into an executable web context—so I keep it at HIGH, not CRITICAL.

Why this verdict

• Unauthenticated RCE is real once a writable JSP-capable context exists; attacker position is pure network remote with no credentials or user interaction.
• Configuration friction materially narrows exposure: the chain usually requires readonly=false or equivalent writable PUT handling, which implies operator customization and knocks this down from generic internet-wide RCE.
• KEV + public weaponization push it back up: CISA lists active exploitation, Rapid7 has a Metasploit module, and NVD references Exploit-DB, so misconfigured instances are low-effort targets.
• Exposure population is meaningful but not universal: public internet datasets still show a large observed footprint, yet many of those hosts will fail exploitation because modern proxies, WAFs, and sane servlet defaults stop PUT-to-JSP paths.
• Blast radius is app-tier dependent: compromise is usually at the Tomcat service account first, not instant domain admin, but app secrets, databases, and shared middleware hosts can turn that into full environment damage quickly.

Why not higher?

I am not calling this CRITICAL because the attack path has a hard real-world choke point: non-default writable PUT into executable content. Requiring that deployment choice means a large fraction of nominally vulnerable Tomcat versions are not actually one-request-owned. That is exactly the kind of compounding friction that should keep a KEV-listed RCE out of the top bucket.

Why not lower?

I am not dropping this to MEDIUM because once the prerequisite exists, exploitation is unauthenticated, remote, and operationally easy. KEV status removes any debate about whether attackers care, and public exploit tooling removes most skill barriers.

1. Block PUT at the edge — Deny PUT and DELETE to Tomcat sites at the reverse proxy, load balancer, API gateway, and WAF unless a business owner can prove they are required. Because this CVE is KEV-listed, deploy this immediately, within hours as the temporary brake while patching catches up.
2. Force readonly=true on DefaultServlet — Audit global conf/web.xml and any app-specific servlet overrides to ensure the DefaultServlet is not writable. This removes the exploit's enabling condition and should be validated immediately, within hours on internet-facing tiers.
3. Hunt for rogue JSPs — Search Tomcat webroots for newly created or unsigned .jsp files, especially tiny web shells and timestamp outliers, then correlate with HTTP PUT requests. Run this immediately, within hours on exposed estates because compromise, if present, is likely already post-exploitation.
4. Constrain Tomcat service privileges — Run Tomcat under a dedicated low-privilege account with minimal filesystem write access outside intended temp/work directories, and restrict outbound network paths to only required dependencies. This reduces blast radius and should be enforced within hours for exposed hosts, then normalized estate-wide during the remediation cycle.
5. Enable webroot and process telemetry — Collect file-create events under deployed app directories and alert on Tomcat spawning shells, script interpreters, or unexpected child processes. Instrumentation should land within hours on exposed systems because it catches both exploitation attempts and already-planted web shells.

Run this on the target Tomcat host or against an unpacked Tomcat filesystem from an auditor workstation. Invoke it as python3 verify_tomcat_cve_2017_12617.py /opt/tomcat and give it read access to the Tomcat install/base directory; root/admin is not required unless file permissions are locked down.

#!/usr/bin/env python3
# verify_tomcat_cve_2017_12617.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import re
import sys
import zipfile
import xml.etree.ElementTree as ET


def parse_version_tuple(v):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', v or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def read_manifest_version(base):
    candidates = [
        os.path.join(base, 'lib', 'catalina.jar'),
        os.path.join(base, 'lib', 'bootstrap.jar'),
    ]
    for jar in candidates:
        if not os.path.isfile(jar):
            continue
        try:
            with zipfile.ZipFile(jar, 'r') as zf:
                data = zf.read('META-INF/MANIFEST.MF').decode('utf-8', 'ignore')
            for line in data.splitlines():
                if line.lower().startswith('implementation-version:'):
                    return line.split(':', 1)[1].strip()
        except Exception:
            pass
    return None


def find_defaultservlet_readonly_false(webxml_path):
    try:
        tree = ET.parse(webxml_path)
        root = tree.getroot()
    except Exception:
        return None

    # Handle possible namespaces crudely
    def local(tag):
        return tag.split('}', 1)[-1]

    servlets = [e for e in root.iter() if local(e.tag) == 'servlet']
    for servlet in servlets:
        servlet_name = None
        servlet_class = None
        readonly_value = None
        for child in list(servlet):
            lt = local(child.tag)
            text = (child.text or '').strip()
            if lt == 'servlet-name':
                servlet_name = text
            elif lt == 'servlet-class':
                servlet_class = text
            elif lt == 'init-param':
                pname = None
                pvalue = None
                for pchild in list(child):
                    plt = local(pchild.tag)
                    ptext = (pchild.text or '').strip()
                    if plt == 'param-name':
                        pname = ptext
                    elif plt == 'param-value':
                        pvalue = ptext
                if pname == 'readonly':
                    readonly_value = pvalue

        is_default = (servlet_name == 'default') or (servlet_class and servlet_class.endswith('DefaultServlet'))
        if is_default and readonly_value is not None:
            return readonly_value.lower() == 'false'

    return None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 verify_tomcat_cve_2017_12617.py <CATALINA_BASE_or_HOME>')
        sys.exit(2)

    base = sys.argv[1]
    if not os.path.isdir(base):
        print(f'UNKNOWN - path not found: {base}')
        sys.exit(2)

    version = read_manifest_version(base)
    vt = parse_version_tuple(version)
    if not vt:
        print('UNKNOWN - could not determine Tomcat version from manifest')
        sys.exit(2)

    # Plugin 103782 is Tomcat 7 only.
    if vt[0] != 7:
        print(f'UNKNOWN - detected Tomcat {version}; this check is scoped to Tomcat 7 / plugin 103782')
        sys.exit(2)

    fixed = (7, 0, 82)
    if vt >= fixed:
        print(f'PATCHED - detected Tomcat {version} (>= 7.0.82)')
        sys.exit(0)

    webxml = os.path.join(base, 'conf', 'web.xml')
    if not os.path.isfile(webxml):
        print(f'UNKNOWN - detected Tomcat {version} but could not read {webxml}')
        sys.exit(2)

    readonly_false = find_defaultservlet_readonly_false(webxml)
    if readonly_false is True:
        print(f'VULNERABLE - detected Tomcat {version} and DefaultServlet readonly=false in conf/web.xml')
        sys.exit(1)
    elif readonly_false is False:
        print(f'UNKNOWN - detected Tomcat {version} (< 7.0.82), but global conf/web.xml keeps readonly=true; app-specific overrides or upstream PUT handling still need review')
        sys.exit(2)
    else:
        print(f'UNKNOWN - detected Tomcat {version} (< 7.0.82), but could not determine DefaultServlet readonly setting')
        sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Tenable Plugin 103782
2. Apache Tomcat 7 Security Page
3. NVD CVE-2017-12617
4. Ubuntu CVE-2017-12617 Backport Status
5. Rapid7 Metasploit Module: Tomcat JSP Upload Bypass
6. FIRST EPSS Documentation
7. Bitsight Groma Observation Footprint for CVE-2017-12617
8. CVE Record