PT-2017-2777 · Apache+5 · Apache Tomcat+5

Rick Riemer · Published 2017-06-26 · Updated 2023-12-08 · CVE-2017-7674

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 9.0.0.M1 through 9.0.0.M21 Apache Tomcat versions 8.5.0 through 8.5.15 Apache Tomcat versions 8.0.0.RC1 through 8.0.44 Apache Tomcat versions 7.0.41 through 7.0.78

Description The issue is related to the CORS Filter in Apache Tomcat, which did not add an HTTP Vary header indicating that the response varies depending on Origin. This allowed for client and server-side cache poisoning in certain circumstances. The vulnerability is caused by incorrect authentication of data and can be exploited by a remote attacker to infect clients and servers under specific conditions.

Recommendations For Apache Tomcat versions 9.0.0.M1 through 9.0.0.M21, update to a version that includes the fix for the CORS Filter issue. For Apache Tomcat versions 8.5.0 through 8.5.15, update to a version that includes the fix for the CORS Filter issue. For Apache Tomcat versions 8.0.0.RC1 through 8.0.44, update to a version that includes the fix for the CORS Filter issue. For Apache Tomcat versions 7.0.41 through 7.0.78, update to a version that includes the fix for the CORS Filter issue. As a temporary workaround, consider restricting access to the CORS Filter until a patch is available.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

ALT-PU-2017-2659

BDU:2017-02035

CESA-2017_3081

CVE-2017-7674

DLA-1400-1

DLA-1400-2

DSA-3974-1

GHSA-73RX-3F9R-X949

MGASA-2017-0352

OPENSUSE-SU-2017_3069-1

RHSA-2017:1801

RHSA-2017:3081

RHSA-2017_3081

SUSE-SU-2017:3039-1

SUSE-SU-2017:3059-1

SUSE-SU-2017:3279-1

USN-3519-1

Affected Products

Alt Linux

Apache Tomcat

Centos

Red Hat

Suse

Ubuntu

References · 115

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb · Exploit
• 🔥 https://github.com/cyberheartmi9/CVE-2017-12617 · Exploit
• 🔥 https://github.com/breaktoprotect/CVE-2017-12615 · Exploit
• 🔥 https://github.com/mefulton/cve-2017-12615 · Exploit
• 🔥 https://github.com/BeyondCy/CVE-2017-12615 · Exploit
• 🔥 https://github.com/Pa55w0rd/CVE-2018-1305 · Exploit
• 🔥 https://github.com/1337g/CVE-2017-12615 · Exploit
• 🔥 https://github.com/zi0Black/POC-CVE-2017-12615-or-CVE-2017-12717 · Exploit
• 🔥 https://github.com/LongWayHomie/CVE-2017-12617 · Exploit
• 🔥 https://github.com/knqyf263/CVE-2018-1304 · Exploit
• https://ubuntu.com/security/CVE-2017-7674 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3519-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:3059-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02035 · Security Note
• https://access.redhat.com/errata/RHSA-2017:1801 · Vendor Advisory