The Tomcat-CVE-2024-50379-PoC is a proof-of-concept tool designed to demonstrate the exploitation of a critical vulnerability in Apache Tomcat, identified as CVE-2024-50379.
This vulnerability, with a CVSS score of 9.8, arises from a Time-of-check Time-of-use (TOCTOU) race condition during JavaServer Pages (JSP) compilation.
Under specific configurations, this flaw can lead to Remote Code Execution (RCE), posing significant risks to systems running vulnerable versions of Apache Tomcat.
CVE-2024-50379 exploits a race condition in case-insensitive file systems (e.g., Windows). The vulnerability occurs when:
file.jsp
vs. FILE.JSP
) during this narrow time window.For exploitation, the default servlet must be configured to allow write operations—a non-default setting.
The PoC script simulates this attack by automating the exploitation process. It enables users to:
To run the PoC:
go run main.go -u http://localhost:8080/
Replace http://localhost:8080/
with the target URL.
Features:
Limitations:
To secure systems against CVE-2024-50379:
This PoC serves as an educational tool for understanding and addressing critical vulnerabilities in Apache Tomcat environments.
It should only be used for legitimate security research and testing purposes, as unauthorized use is illegal and unethical.
Learn how to create and use Bash functions with this complete tutorial. Includes syntax, arguments,…
Introduction Unlock the full potential of your Linux system with this comprehensive guide to essential…
Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…
JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…
The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…
Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…