CVE-2017-12617 — Unrestricted Upload of File with Dangerous Type Apache Tomcat

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Tomcat	9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, 7.0.0 to 7.0.81	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 7	tomcat7	7.0.28-4+deb7u16	DLA-1166-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	tomcat8	8.5.30-1ubuntu1.2	USN-3665-1
Ubuntu 16.04 LTS	tomcat8	8.0.32-1ubuntu1.6	USN-3665-1
Ubuntu 14.04 LTS	tomcat7	7.0.52-1ubuntu0.14	USN-3665-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	tomcat7	No fix yet	—
Ubuntu Pro 16.04 LTS	tomcat7	7.0.68-1ubuntu0.4+esm3	USN-7282-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	tomcat +9	7.0.76-3.el7_4	RHSA-2017:3081
RHEL 6	tomcat6 +8	6.0.24-111.el6_9	RHSA-2017:3080

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 3	mod_cluster +2	1.3.8-2.Final_redhat_2.1.ep7.el6	RHSA-2018:0466
Red Hat JBoss Web Server 3	tomcat-native	1.2.8-11.redhat_11.ep7.el6	RHSA-2018:0466
Red Hat JBoss Web Server 3	tomcat-vault +2	1.1.6-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0466
Red Hat JBoss Web Server 3	tomcat7 +11	7.0.70-25.ep7.el6	RHSA-2018:0466
Red Hat JBoss Web Server 3	tomcat8 +11	8.0.36-29.ep7.el6	RHSA-2018:0466
Red Hat JBoss Web Server 2	httpd +4	2.2.26-57.ep6.el6	RHSA-2017:3113
Red Hat JBoss Web Server 2	httpd22 +4	2.2.26-58.ep6.el7	RHSA-2017:3113
Red Hat JBoss Web Server 2	jbcs-httpd24-openssl +4	1:1.0.2h-14.jbcs.el6	RHSA-2017:3113
Red Hat JBoss Web Server 2	mod_cluster-native	1.2.13-9.Final_redhat_2.ep6.el6	RHSA-2017:3113
Red Hat JBoss Web Server 2	mod_ssl	1:2.2.26-57.ep6.el6	RHSA-2017:3113
Red Hat JBoss Web Server 2	mod_ssl22	1:2.2.26-58.ep6.el7	RHSA-2017:3113
Red Hat JBoss Web Server 2	tomcat6 +10	6.0.41-19_patch_04.ep6.el6	RHSA-2017:3113
Red Hat JBoss Web Server 2	tomcat7 +10	7.0.54-28_patch_05.ep6.el6	RHSA-2017:3113
Red Hat JBoss EAP 6	hornetq	2.3.25-25.SP23_redhat_1.1.ep6.el5	RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6	infinispan +4	5.2.23-1.Final_redhat_1.1.ep6.el5	RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6	ironjacamar-eap6 +9	1.0.41-1.Final_redhat_1.1.ep6.el5	RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6	jboss-as-ee +62	7.5.19-2.Final_redhat_2.1.ep6.el5	RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6	jboss-ec2-eap +1	7.5.19-2.Final_redhat_2.ep6.el6	RHSA-2018:0275
Red Hat JBoss EAP 6	jboss-ejb-client	1.0.40-1.Final_redhat_1.1.ep6.el5	RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6	jboss-remoting3	3.3.12-2.Final_redhat_2.1.ep6.el5	RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6	jbossweb	7.5.27-1.Final_redhat_1.1.ep6.el5	RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6	jbossws-cxf	4.3.7-1.Final_redhat_1.1.ep6.el5	RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6	picketlink-bindings	2.5.4-22.SP18_redhat_1.1.ep6.el5	RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6	picketlink-federation	2.5.4-20.SP18_redhat_1.1.ep6.el5	RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 12 SP3	tomcat	8.0.43-29.5.1	SUSE-SU-2017:3039-1
SLES 12 SP2	tomcat	8.0.43-29.5.1	SUSE-SU-2017:3039-1
SLES 12 SP1	tomcat	8.0.43-10.24.1	SUSE-SU-2017:3279-1
SLES 12	tomcat	7.0.82-7.16.1	SUSE-SU-2017:3059-1
SLES 11 SP4	tomcat6	6.0.53-0.57.19.1	SUSE-SU-2021:14705-1

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP3	tomcat	8.0.43-29.5.1	SUSE-SU-2017:3039-1
SLES for SAP 12 SP2	tomcat	8.0.43-29.5.1	SUSE-SU-2017:3039-1
SLES for SAP 12 SP1	tomcat	8.0.43-10.24.1	SUSE-SU-2017:3279-1
SUSE OpenStack Cloud 6	tomcat	8.0.43-10.24.1	SUSE-SU-2017:3279-1
SUSE Linux Enterprise Point of Sale 11 SP3	tomcat6	6.0.53-0.57.19.1	SUSE-SU-2021:14705-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	tomcat	9.0.36-8.4	openSUSE-SU-2024:11468-1
openSUSE Tumbleweed	tomcat10	10.1.14-1.1	openSUSE-SU-2024:13441-1

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	tomcat +9	7.0.76-3.el7_4	ELSA-2017-3081

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Tomcat RCE via JSP Upload Bypass
exploit/multi/http/tomcat_jsp_upload_bypass

Exploit-DB 2

Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit) EDB-43008 · remote · Oct 17, 2017 · verified
Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2) EDB-42966 · webapps · Oct 9, 2017 · verified

GitHub 10 repositories

cyberheartmi9/CVE-2017-12617 ★ 400 · Oct 5, 2017

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution
LongWayHomie/CVE-2017-12617 ★ 6 · Dec 10, 2021

CVE-2017-12617 is a critical vulnerability leading to Remote Code Execution (RCE) in Apache Tomcat.
ygouzerh/CVE-2017-12617 ★ 2 · Jan 14, 2019

Proof of Concept - RCE Exploitation : Web Shell on Apache Tomcat - Ensimag January 2018
jptr218/tc_hack ★ 1 · Jul 27, 2021

An implementation of CVE-2017-12617
tyranteye666/tomcat-cve-2017-12617 ★ 1 · Feb 4, 2021

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution for Python3
DevaDJ/CVE-2017-12617 ★ 0 · Dec 13, 2024

Improved version of PikaChu CVE
yZee00/CVE-2017-12617 ★ 0 · Jul 4, 2024

CVE-2017-12617
scirusvulgaris/CVE-2017-12617 ★ 0 · Jun 28, 2024
qiantu88/CVE-2017-12617 ★ 0 · Dec 19, 2018
devcoinfet/CVE-2017-12617 ★ 0 · Feb 9, 2018

Code put together from a few peoples ideas credit given don't use maliciously please

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Apache Tomcat - Remote Code Execution http/cves/2017/CVE-2017-12617.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat-catalina	>= 9.0.0.M1, < 9.0.1	9.0.1	GHSA-xjgh-84hx-56c5
Maven	org.apache.tomcat:tomcat-catalina	>= 8.5.0, < 8.5.23	8.5.23	GHSA-xjgh-84hx-56c5
Maven	org.apache.tomcat:tomcat-catalina	>= 8.0.0-RC1, < 8.0.47	8.0.47	GHSA-xjgh-84hx-56c5
Maven	org.apache.tomcat:tomcat-catalina	>= 7.0.0, < 7.0.82	7.0.82	GHSA-xjgh-84hx-56c5
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 9.0.0.M1, < 9.0.1	9.0.1	GHSA-xjgh-84hx-56c5
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 8.5.0, < 8.5.23	8.5.23	GHSA-xjgh-84hx-56c5
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 8.0.0-RC1, < 8.0.47	8.0.47	GHSA-xjgh-84hx-56c5
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 7.0.0, < 7.0.82	7.0.82	GHSA-xjgh-84hx-56c5

Advisories 22

RHSA-2017:3113 Red Hat Security Advisory: Red Hat JBoss Web Server security and bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2018:0466 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2018:0271 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.19 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:0275 Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:0268 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.19 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:0270 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.19 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2017:3081 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2017:3080 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
USN-7282-1 tomcat7 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
USN-3665-1 tomcat7, tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DLA-1166-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2017:3039-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2017:3059-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2017:3279-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:11468-1 tomcat-9.0.36-8.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:14705-1 Security update for tomcat6 SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2025-1212 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 2, 2025
WID-SEC-2025-0422 Apache Tomcat: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Feb 20, 2025
WID-SEC-2024-1238 HPE HP-UX: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 27, 2024
WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
ELSA-2017-3081 Important: tomcat security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 30, 2017

References

RHSA-2017:3113 vendor-advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
RHSA-2017:3080 vendor-advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us
RHSA-2018:0269 vendor-advisory
42966 exploit
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us
RHSA-2018:0270 vendor-advisory
RHSA-2018:0271 vendor-advisory
[debian-lts-announce] 20171107 [SECURITY] [DLA 1166-1] tomcat7 security update mailing-list
RHSA-2018:2939 vendor-advisory
RHSA-2018:0465 vendor-advisory
USN-3665-1 vendor-advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
RHSA-2018:0268 vendor-advisory
RHSA-2017:3114 vendor-advisory
43008 exploit
1039552 vdb-entry
100954 vdb-entry
RHSA-2018:0275 vendor-advisory
RHSA-2018:0466 vendor-advisory
[announce] 20171003 [SECURITY] CVE-2017-12617 Apache Tomcat Remote Code Execution via JSP upload mailing-list
https://security.netapp.com/advisory/ntap-20171018-0002/
https://security.netapp.com/advisory/ntap-20180117-0002/
RHSA-2017:3081 vendor-advisory
[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
https://support.f5.com/csp/article/K53173544
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list

EUVD	v3.1	8.1
CISA-ADP	v3.1	8.1
OSV:GHSA	v3.0	8.1