exploit-tomcat

name	exploit-tomcat
description	Apache Tomcat CVE-2017-12615 PUT arbitrary file upload RCE via JSP webshell. Targets Tomcat instances with HTTP PUT enabled and write permissions on the webroot.
metadata	{"openclaw":{"emoji":"💥","requires":{"bins":["python3","curl"],"env":[]},"primaryEnv":null}}

exploit-tomcat

Exploits Apache Tomcat's misconfigured HTTP PUT handler (CVE-2017-12615) to upload a JSP webshell and achieve remote code execution.

Target Framework

Apache Tomcat 7.0.0 - 7.0.81 with readonly init parameter set to false in DefaultServlet config (enabled by some deployment templates).

Usage

Provide target (Tomcat base URL). The skill uploads a JSP webshell via HTTP PUT and executes a command through it, returning output.

Parameters

Param	Type	Required	Description
target	string	yes	Base URL of the Tomcat instance
cmd	string	no	OS command to execute (default: id)
path	string	no	Upload path override (default: /upload.jsp/)
timeout	int	no	Timeout in seconds (default: 30)

Notes

Affects Tomcat 7.x; check version with httpx/whatweb before use. The trailing slash trick (/upload.jsp/) bypasses the JSP execution filter during upload.