PRP: CVE-2017-12617 - Apache Tomcat RCE via JSP Upload

[LeonardoE95]

Hi there.

I would like to implement a plugin to detect an Apache Tomcat RCE (CVE-2017-12617) affecting installation that are configured with readonly set to false.

The issue allows unauthenticated actors to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Initially the vulnerability was found in the context of windows (CVE-2017-12615), and later it was discovered as a more widespread issue, affecting all operating systems that run Apache Tomcat with vulnerable versions (CVE-2017-12617).

References:
https://nvd.nist.gov/vuln/detail/cve-2017-12617
https://www.exploit-db.com/exploits/42966
https://nvd.nist.gov/vuln/detail/cve-2017-12615

Affected Versions of Apache Tomcat
7.0.0 to 7.0.81
8.0.0 RC1 to 8.0.46
8.5.0 to 8.5.22
9.0.0 M1 to 9.0.0

Thanks.

[maoning]

@LeonardoE95 You can start working on this plugin now, please link the PR to this issue once it is ready.