PT-2017-16656 · Apache+5 · Apache Tomcat+5

Published 2017-05-10 · Updated 2024-06-15 · CVE-2017-5664

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 9.0.0.M1 through 9.0.0.M20 Apache Tomcat versions 8.5.0 through 8.5.14 Apache Tomcat versions 8.0.0.RC1 through 8.0.43 Apache Tomcat versions 7.0.0 through 7.0.77

Description The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page with the original HTTP method. If the error page is a static file, expected behavior is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat did not do this, which could lead to unexpected and undesirable results for static error pages, including the replacement or removal of the custom error page if the DefaultServlet is configured to permit writes. JSPs and custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Recommendations For Apache Tomcat versions 9.0.0.M1 through 9.0.0.M20, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 8.5.0 through 8.5.14, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 8.0.0.RC1 through 8.0.43, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 7.0.0 through 7.0.77, update to a version outside of this range to resolve the issue. As a temporary workaround, consider configuring error pages to handle any error dispatch as a GET request, regardless of the actual method, to minimize the risk of exploitation.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

ALT-PU-2017-2659

CESA-2017_1809

CESA-2017_3080

CVE-2017-5664

DLA-996-1

DSA-3891-1

DSA-3892-1

GHSA-JMVV-524F-HJ5J

MGASA-2017-0196

OPENSUSE-SU-2017_3069-1

OPENSUSE-SU-2024:11468-1

OPENSUSE-SU-2024:13441-1

RHSA-2017:1801

RHSA-2017:1809

RHSA-2017:2493

RHSA-2017:2635

RHSA-2017:2636

RHSA-2017:2637

RHSA-2017:2638

RHSA-2017:3080

RHSA-2017_1809

RHSA-2017_3080

SUSE-SU-2017:3039-1

SUSE-SU-2017:3059-1

SUSE-SU-2017:3279-1

SUSE-SU-2018:1847-1

USN-3519-1

Affected Products

Alt Linux

Apache Tomcat

Centos

Red Hat

Suse

Ubuntu

References · 169

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb · Exploit
• 🔥 https://github.com/cyberheartmi9/CVE-2017-12617 · Exploit
• 🔥 https://github.com/breaktoprotect/CVE-2017-12615 · Exploit
• 🔥 https://github.com/mefulton/cve-2017-12615 · Exploit
• 🔥 https://github.com/BeyondCy/CVE-2017-12615 · Exploit
• 🔥 https://github.com/1337g/CVE-2017-12615 · Exploit
• 🔥 https://github.com/zi0Black/POC-CVE-2017-12615-or-CVE-2017-12717 · Exploit
• 🔥 https://github.com/LongWayHomie/CVE-2017-12617 · Exploit
• https://osv.dev/vulnerability/MGASA-2017-0196 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:3279-1 · Vendor Advisory
• http://debian.org/security/2017/dsa-3892 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2493 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2638 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3080 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3892-1 · Vendor Advisory