Apache Tomcat Remote Code Execution Vulnerability via JSP Upload

A remote code execution vulnerability has been identified in Apache Tomcat versions 9.0.0.M1 prior to 9.0.0, 8.5.0 prior to 8.5.23, 8.0.0.RC1 prior to 8.0.47, and 7.0.0 prior to 7.0.82. When HTTP PUT requests were enabled, it was possible to upload a JSP file to the server through a specially crafted request. The uploaded JSP file could then be accessed, and any code it contained would be executed by the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server.

Reproduction

To reproduce this vulnerability, upload a JSP file to a vulnerable Tomcat server with HTTP PUT requests enabled. This can be done by sending a crafted HTTP PUT request that includes the JSP file. Once the file is uploaded, it can be accessed through the server, and any code within the JSP file will be executed.

Remediation

Users should upgrade to Apache Tomcat 9.0.1 or later, 8.5.23 or later, 8.0.47 or later, or 7.0.82 or later.