| name | exploit-tomcat |
| description | Apache Tomcat CVE-2017-12615 PUT arbitrary file upload RCE via JSP webshell. Targets Tomcat instances with HTTP PUT enabled and write permissions on the webroot. |
| metadata | {"openclaw":{"emoji":"💥","requires":{"bins":["python3","curl"],"env":[]},"primaryEnv":null}} |
exploit-tomcat
Exploits Apache Tomcat's misconfigured HTTP PUT handler (CVE-2017-12615) to upload a JSP webshell and achieve remote code execution.
Target Framework
Apache Tomcat 7.0.0 - 7.0.81 with readonly init parameter set to false in DefaultServlet config (enabled by some deployment templates).
Usage
Provide target (Tomcat base URL). The skill uploads a JSP webshell via HTTP PUT and executes a command through it, returning output.
Parameters
| Param | Type | Required | Description |
|---|
| target | string | yes | Base URL of the Tomcat instance |
| cmd | string | no | OS command to execute (default: id) |
| path | string | no | Upload path override (default: /upload.jsp/) |
| timeout | int | no | Timeout in seconds (default: 30) |
Notes
Affects Tomcat 7.x; check version with httpx/whatweb before use. The trailing slash trick (/upload.jsp/) bypasses the JSP execution filter during upload.
