Apache Tomcat 7.0.x Windows Remote Code Execution Vulnerability (CVE-2017-12615) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability exists in the DefaultServlet of Apache Tomcat 7.0.x running on Windows environments. When the 'readonly' initialization parameter is explicitly set to 'false', Tomcat permits HTTP PUT requests to upload files to the server. Due to a discrepancy between Java's file handling APIs and the underlying Windows Win32 file system behavior, attackers can bypass extension validation checks by appending special characters (such as '/' or '::$DATA') to the request URI, allowing arbitrary JSP files to be written to the web root.

2. Exploitation Mechanics & Attack Scenario

The exploitation flow typically proceeds as follows:

• Crafted Request: The attacker sends an HTTP PUT request targeting a JSP path with trailing characters, such as PUT /shell.jsp/ or PUT /shell.jsp::$DATA.
• Validation Bypass: Tomcat's internal validation logic treats the URI as a directory or an alternate data stream, bypassing the standard JSP upload restrictions.
• File Creation: When Windows processes the file creation call, the trailing slash or stream identifier is stripped, resulting in a file named shell.jsp being written to disk.
• Execution: The attacker requests the uploaded JSP file via HTTP GET, triggering remote code execution on the target server.

3. Infrastructure & Business Impact

With a CVSS score of 8.1 and active exploitation status in CISA's KEV catalog (EPSS score: 0.9971), this vulnerability poses an extreme risk. Successful exploitation grants the attacker the ability to execute arbitrary system commands, potentially leading to full host compromise, lateral movement within the internal network, data exfiltration, and deployment of ransomware.