Critical Remote Code Execution in Apache Tomcat on Windows (CVE‑2017‑12615) Enables Arbitrary JSP Upload
What It Is – Apache Tomcat running on Windows that has the HTTP PUT method enabled can be tricked into accepting a malicious JSP file via a crafted request. When the uploaded JSP is later accessed, the embedded code runs on the server, giving an attacker remote code execution.
Exploitability – Public exploits exist; the vulnerability carries a CVSS 3.0 base score of 9.8 (Critical).
Affected Products – Apache Tomcat (any version on Windows where HTTP PUT is enabled).
Why It Matters for Trust & Control Assurance
- Configuration‑management controls must be demonstrably enforced; a mis‑enabled HTTP PUT defeats that assurance.
- Continuous monitoring of server settings provides audit‑ready evidence that only approved configurations are in place.
- Mapping this gap to a control objective (secure configuration) satisfies multiple frameworks simultaneously, giving buyers a defensible trust signal.
Recommended Actions
- Disable HTTP PUT on all Tomcat instances unless a business case justifies it.
- Apply the latest Tomcat security patches that address CVE‑2017‑12615.
- Run a configuration audit, capture evidence of the disabled method, and store it in a tamper‑evident repository.
- Implement continuous monitoring to alert on any re‑enabling of HTTP PUT or unexpected file uploads.
Source: CISA KEV – CVE‑2017‑12615