2

CVE-2017-12617 is a remote code execution vulnerability via JSP upload. It requires the HTTP PUT method to be enabled on a vulnerable tomcat instance.

Why is this considered a vulnerability and CVE worthy? Doesn't enabling HTTP PUT on web servers always imply that files can be uploaded to the server, which are consequently processed / executed in the context of the web server when requested?

2
  • 1
    Maybe this makes it more clear: alphabot.com/security/blog/2017/java/…
    – Tom K.
    Commented Nov 17, 2017 at 12:28
  • Ah right, so the vulnerability is actually in the filter that should prevent uploading JSP-files. Thanks for clearing this out. Commented Nov 17, 2017 at 12:38

1 Answer 1

2

From the CVE

This JSP could then be requested and any code it contained would be executed by the server.

PUT suggests a resource will be placed. But unless the API explicitly states so it does not imply it will change execution behaviour of the server.

10
  • I think this is not well-stated in the CVE. The JSP is not automatically executed after it is uploaded. You have to access the JSP via HTTP to let the server execute it.
    – Tom K.
    Commented Nov 17, 2017 at 12:56
  • @Tom - yes, but any attacker can send a GET request. It explicitly states that to be executed it has to be requested. What could they change?
    – Hector
    Commented Nov 17, 2017 at 12:59
  • Ah... don't mind my comment then. I misread that.
    – Tom K.
    Commented Nov 17, 2017 at 13:00
  • This is true, but I don't think this should be considered the vulnerability. This statement holds for any JSP file that is somehow uploaded and requested. Tom's comment linking to the actual blog contains the answer: It was discovered that the filter that prevents the uploading of JavaServer Pages (.jsp) can be circumvented. Commented Nov 17, 2017 at 15:15
  • @Onderbetaald - Sure. But that is just a bug. The exploit/vulnerability is that it can then be executed which leads to remote code execution.
    – Hector
    Commented Nov 17, 2017 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .