EXAMPLE.json

{
  "s_no": "001",
  "name_of_vulnerability": "Apache Tomcat HTTP PUT Method Remote Code Execution",
  "severity": "High",
  "vulnerable_location": "<network-target-hostname> @ <ip> — Apache Tomcat (port 8080)",
  "vulnerable_path_port_url": "http://<ip>:8080/",
  "vulnerable_parameter": "HTTP PUT request body (.jsp upload)",
  "cve_cwe": "CWE-434, CVE-2017-12617",
  "cvss_epss_score": "CVSS v3.1 Base 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) — High; EPSS 94.50% (lookup YYYY-MM-DD)",
  "description": "Apache Tomcat is configured with HTTP PUT method enabled and the default servlet writable. An unauthenticated remote attacker can upload a JSP webshell via PUT, then request it to execute arbitrary code as the Tomcat service account. (Illustrative example only — replace with your own evidence.)",
  "poc_intro": "Requires only a web client capable of issuing HTTP PUT (curl, Burp). No credentials needed.",
  "poc_steps": [
    {"step_number": 1, "caption": "OPTIONS request to / shows PUT is in the Allow header — server accepts file writes", "image_path": "poc/server/01_Tomcat_HTTP_PUT_Method_RCE/1_options_response_put_enabled.png"},
    {"step_number": 2, "caption": "PUT /shell.jsp with a JSP webshell payload returns 201 Created — file written to webroot", "image_path": "poc/server/01_Tomcat_HTTP_PUT_Method_RCE/2_jsp_uploaded_via_put.png"},
    {"step_number": 3, "caption": "GET /shell.jsp?cmd=id returns uid=tomcat — arbitrary command execution as the Tomcat service account", "image_path": "poc/server/01_Tomcat_HTTP_PUT_Method_RCE/3_command_execution.png"}
  ],
  "recommendations": [
    "Upgrade Apache Tomcat to 7.0.82, 8.0.47, 8.5.23, 9.0.1 or later.",
    "Set the default servlet's `readonly` parameter to `true` in conf/web.xml.",
    "Run Tomcat under a least-privilege service account.",
    "Add an upstream WAF or reverse-proxy rule that blocks HTTP PUT to .jsp / .war paths."
  ],
  "references": "https://cwe.mitre.org/data/definitions/434.html\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-12617\nhttps://tomcat.apache.org/security-7.html\nhttps://api.first.org/data/v1/epss?cve=CVE-2017-12617",
  "additional_observations": "Illustrative entry showing the universal schema. In a real engagement, if the host runs a CI/CD agent, a successful upload may also expose build artifacts and source code — note this in the chain analysis.",
  "cwe_cve_audit": "MITRE https://cwe.mitre.org/data/definitions/434.html — Usage: ALLOWED (Unrestricted Upload of File with Dangerous Type). NVD https://nvd.nist.gov/vuln/detail/CVE-2017-12617 — affected: Apache Tomcat 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, 7.0.0 to 7.0.81 when running on Windows with HTTP PUT enabled. EPSS api.first.org/data/v1/epss?cve=CVE-2017-12617 — {\"cve\":\"CVE-2017-12617\",\"epss\":\"0.94500\",\"percentile\":\"0.99960\",\"date\":\"YYYY-MM-DD\"}.",
  "cvss_audit": "AV:N (HTTP service exposed), AC:H (requires PUT-writable servlet + correct file-extension handling), PR:N (no auth), UI:N (no victim interaction), S:U (Tomcat process scope), C:H/I:H/A:H (code execution as Tomcat user yields full read/write/destroy). ISC_base = 1 - (1-0.56)(1-0.56)(1-0.56) = 0.8521; Impact = 6.42 × 0.8521 = 5.473; Exploitability = 8.22 × 0.85 × 0.44 × 0.85 × 0.85 = 2.222; Base = roundup(min(Impact+Exploit, 10)) = roundup(7.69) = 7.7. [NVD reports 8.1 — small discrepancy from AC weight interpretation; defer to NVD for citation.]"
}