漏洞描述
Apache Tomcat servers 7.0.{0 to 79} are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to the insufficient checks, an attacker could gain remote code execution on Apache Tomcat servers that have enabled PUT method by using a specially crafted HTTP request.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615↗lists.apache.orghttps://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c@%3Cannounce.tomcat.apache.org%3E↗web.archive.orghttp://web.archive.org/web/20211206035549/https://securitytracker.com/id/1039392↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2017-12615↗breaktoprotect.blogspot.comhttp://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html↗