Horizon Alert
Summary of the vulnerability and why it matters
Apache Tomcat is vulnerable when HTTP PUT requests are enabled and the default servlet's `readonly` parameter is set to `false`. This misconfiguration allows an attacker to upload a JavaServer Pages (JSP) file to the server via a crafted request. Once uploaded, the server can be instructed to execute any code contained within that JSP file, potentially leading to unauthorized command execution and data compromise.
- Vulnerable Apache Tomcat component
- Allows uploading and executing JSP files
- Enables unauthorized code executionApache Tomcat is vulnerable when HTTP PUT requests are enabled and the default servlet's `readonly` parameter is set to `false`. This misconfiguration allows an attacker to upload a JavaServer Pages (JSP) file to the server via a crafted request. Once uploaded, the server can be instructed to execute any code contained within that JSP file, potentially leading to unauthorized command execution and data compromise.
- Vulnerable Apache Tomcat component
- Allows uploading and executing JSP files
- Enables unauthorized code execution
Attack Path
How an attacker could exploit the issue
When HTTP PUT requests are enabled on Apache Tomcat, an attacker can upload a JavaServer Pages (JSP) file. This uploaded file can then be executed by the server, potentially leading to unauthorized code execution. The ability to upload and execute code provides attackers with a pathway to compromise systems and impact business operations.
- Exposed server with PUT enabled
- Attacker uploads malicious JSP
- Executed code allows control
Live Threat
Current exploitation, exposure, and threat context
The assessed threat level for this CVE is HIGH. Attackers with moderate technical skill could exploit this vulnerability if specific configurations are present on the target system. The primary risk involves attackers uploading and executing malicious code, leading to system compromise, data theft, or unauthorized access. Given the potential for severe impact and the availability of exploit code, organizations should prioritize addressing this vulnerability.
- Likely attacker skill level: Moderate
- Required access or conditions: HTTP PUTs enabled, specific configurations
- Business risk or urgency: High
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in Apache Tomcat allows for the execution of arbitrary code on the server if HTTP PUT requests are enabled. Attackers can upload and then execute a JSP file through a specially crafted request, posing a significant risk to organizational systems and data. The exploitability and high severity underscore the need for immediate action to identify and mitigate potential exposure.
- Identify affected Tomcat assets.
- Disable HTTP PUT requests if enabled.
- Apply vendor updates and verify.
- Monitor for related activity.
