Apache Tomcat Remote Code Execution Vulnerability via DefaultServlet readonly Parameter Misconfiguration (CVE-2017-12617)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2017-12617) arises when Apache Tomcat is configured with the 'readonly' initialization parameter of the DefaultServlet set to 'false'. By default, Tomcat sets this parameter to 'true' to prevent external clients from modifying resources on the server. When set to 'false', Tomcat permits HTTP PUT requests. Although Tomcat has built-in mechanisms to reject direct uploads of JSP files, attackers can bypass these restrictions by exploiting file-system behaviors (such as appending a trailing slash '/' or NTFS alternative data streams '::$DATA' on Windows), allowing them to write arbitrary JSP files directly to the web root.

2. Exploitation Mechanics & Attack Scenario

An attacker initiates the exploit by sending an HTTP PUT request containing a malicious JSP payload (WebShell). To bypass Tomcat's extension validation, the attacker crafts the request URI to target a path like /shell.jsp/ or /shell.jsp::$DATA. During the file creation process, the underlying file system or Tomcat's internal file-writing APIs strip the trailing slash or stream identifier, resulting in the creation of a standard shell.jsp file on the disk. Once the file is successfully written, the attacker sends an HTTP GET request to the uploaded JSP file, triggering the execution of the payload within the WAS context and achieving Remote Code Execution (RCE).

3. Infrastructure & Business Impact

Given its inclusion in the CISA KEV catalog and an EPSS score of 0.9997, this vulnerability is highly targeted by automated exploit scripts. Successful exploitation grants the attacker the execution privileges of the Tomcat daemon (often root or SYSTEM). This can lead to complete host compromise, lateral movement within the internal network, database credential theft, and deployment of ransomware, posing a catastrophic risk to business continuity.