2

CVE-2017-12617 is a remote code execution vulnerability via JSP upload. It requires the HTTP PUT method to be enabled on a vulnerable tomcat instance.

Why is this considered a vulnerability and CVE worthy? Doesn't enabling HTTP PUT on web servers always imply that files can be uploaded to the server, which are consequently processed / executed in the context of the web server when requested?

2

From the CVE

This JSP could then be requested and any code it contained would be executed by the server.

PUT suggests a resource will be placed. But unless the API explicitly states so it does not imply it will change execution behaviour of the server.

  • I think this is not well-stated in the CVE. The JSP is not automatically executed after it is uploaded. You have to access the JSP via HTTP to let the server execute it. – Tom K. Nov 17 '17 at 12:56
  • @Tom - yes, but any attacker can send a GET request. It explicitly states that to be executed it has to be requested. What could they change? – Hector Nov 17 '17 at 12:59
  • Ah... don't mind my comment then. I misread that. – Tom K. Nov 17 '17 at 13:00
  • This is true, but I don't think this should be considered the vulnerability. This statement holds for any JSP file that is somehow uploaded and requested. Tom's comment linking to the actual blog contains the answer: It was discovered that the filter that prevents the uploading of JavaServer Pages (.jsp) can be circumvented. – Onderbetaald Nov 17 '17 at 15:15
  • @Onderbetaald - Sure. But that is just a bug. The exploit/vulnerability is that it can then be executed which leads to remote code execution. – Hector Nov 17 '17 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.