Vulnerability Analysis

Understanding And Utilizing The Tomcat – CVE-2024-50379 Proof-of-Concept (PoC)

The Tomcat-CVE-2024-50379-PoC is a proof-of-concept tool designed to demonstrate the exploitation of a critical vulnerability in Apache Tomcat, identified as CVE-2024-50379.

This vulnerability, with a CVSS score of 9.8, arises from a Time-of-check Time-of-use (TOCTOU) race condition during JavaServer Pages (JSP) compilation.

Under specific configurations, this flaw can lead to Remote Code Execution (RCE), posing significant risks to systems running vulnerable versions of Apache Tomcat.

CVE-2024-50379 exploits a race condition in case-insensitive file systems (e.g., Windows). The vulnerability occurs when:

  1. Tomcat checks if it is safe to compile or use a JSP file (time-of-check).
  2. An attacker uploads a malicious JSP file with a different case (e.g., file.jsp vs. FILE.JSP) during this narrow time window.
  3. The malicious file is executed due to inconsistencies in file system handling.

For exploitation, the default servlet must be configured to allow write operations—a non-default setting.

PoC Functionality

The PoC script simulates this attack by automating the exploitation process. It enables users to:

  • Test individual or batch URLs for vulnerability.
  • Exploit the race condition by uploading and executing malicious JSP files.

To run the PoC:

go run main.go -u http://localhost:8080/

Replace http://localhost:8080/ with the target URL.

Features:

  • Demonstrates RCE via the race condition.
  • Provides a basis for testing server configurations against CVE-2024-50379.

Limitations:

  • Requires specific conditions (e.g., case-insensitive file systems and write-enabled default servlet).
  • Does not include robust mechanisms to confirm successful exploitation yet.

To secure systems against CVE-2024-50379:

  1. Upgrade Apache Tomcat: Use patched versions 9.0.98, 10.1.34, or 11.0.2.
  2. Disable Write Access: Ensure the default servlet does not allow write operations.
  3. Secure File Uploads: Avoid allowing JSP files to be uploaded directly into directories served by the application.

This PoC serves as an educational tool for understanding and addressing critical vulnerabilities in Apache Tomcat environments.

It should only be used for legitimate security research and testing purposes, as unauthorized use is illegal and unethical.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

1 hour ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

2 hours ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

21 hours ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

21 hours ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

21 hours ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

3 days ago