Web Server Apache Tomcat JSP File Upload and Deletion

A vulnerable version of Apache Tomcat allows the upload and execution of JSP code or the unrestricted removal of files by appending a forward slash to URI path filenames. This occurs because the default servlet parameter readonly is set to “False”.

Exploitation

Stages

1. The attacker sends an HTTP PUT request with JSP code to the URI path filename containing a trailing forward slash.
2. The server creates the JSP file and returns HTTP 201 to the attacker.
3. Optionally, an attacker can alternatively send an HTTP DELETE request to the URI path filename containing a trailing forward slash.
4. The server deletes the JSP file and returns HTTP 204 to the attacker.

Prerequisites

Apache Tomcat must be configured to allow HTTP PUT/DELETE. Default servlet configuration in tomcat/conf/web.xml must have readonly set to “False”.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Detection of this threat is provided via Alert Logic ActiveWatch for Web Security Manager service. Depending on your deployment of Web Security Manager, you will receive an incident (for out-of-band deployment) or the threat will be actively blocked and rejected (for the inline Web Security Manager Premier deployment) if an exploit attempt is observed.

Recommendations for Mitigation

Upgrade to a non-vulnerable version to mitigate this vulnerability.