search
LinkedInGithub
githubEdit

17. Attacking Tomcat CGI

hashtag
1. Vulnerability Overview

hashtag
CVE-2019-0232 - Remote Code Execution (RCE)

  • Description: Allows remote code execution due to improper input validation in the CGI Servlet when enableCmdLineArguments is set to true.

  • Affected Versions:

    • Tomcat 9.0.0.M1 to 9.0.17

    • Tomcat 8.5.0 to 8.5.39

    • Tomcat 7.0.0 to 7.0.93

  • Cause:

    • The CGI Servlet fails to properly sanitize user-supplied input from the query string, leading to command injection.

hashtag
2. Enumeration

hashtag
Nmap Scan

Identify open ports and running services, particularly Apache Tomcat.

nmap -p- -sC -Pn 10.129.204.227 --open

hashtag
CGI Script Discovery (ffuf)

Discover CGI scripts using directory fuzzing.

This command fuzzes for CGI scripts with the .bat extension and may reveal welcome.bat.

hashtag
3. Exploitation

hashtag
Basic Command Injection

Execute the dir command to list files.

hashtag
Retrieve Environment Variables

Check for useful system environment variables.

This can reveal critical information, such as the PATH variable being unset.

hashtag
Hardcoded Path Execution (whoami)

Attempt to execute whoami.exe by specifying its full path.

This may fail if special characters are filtered.

hashtag
URL Encoding Bypass

Bypass character filtering using URL encoding.

This allows execution of whoami.exe despite input restrictions.

hashtag
4. Key Considerations

  • The enableCmdLineArguments setting must be enabled for this exploit to work.

  • The & character is used to separate commands in the injection.

  • If the PATH environment variable is unset, commands must be executed with their full path.

  • URL encoding can help bypass character filtering.

  • Only test on systems you have explicit permission to assess.

  • Replace IP addresses, ports, and URLs with your specific target information.

hashtag
5. Commands Summary

Previous5. Common Gateway InterfacesNext18. Attacking CPI Applications Shellshock

Last updated