Apache Tomcat JSP Compilation TOCTOU RCE

This repository contains a Python exploit script (exploit.py) targeting Apache Tomcat servers vulnerable to CVE-2024-50379. The exploit attempts to upload a malicious JSP file to the server using HTTP PUT requests to /aa.Jsp and /bb.Jsp, then checks for successful upload and execution by sending GET requests to /aa.jsp and /bb.jsp. The payload in the JSP attempts to execute a reverse shell using ncat, providing the attacker with remote code execution capabilities. The script supports both single URL and batch URL modes (via a text file). The exploit is operational, as it provides a working payload and automates the attack process. The README.md is minimal and only references the CVE. No hardcoded IP addresses or domains are present, but the payload expects the attacker to replace CONNECTION_IP with their own address. The main attack vector is network-based, targeting accessible Tomcat servers over HTTP/HTTPS.

This repository contains a Python proof-of-concept exploit for CVE-2024-50379. The main file, 'Exploit-poc.py', is a command-line tool that targets web servers vulnerable to this CVE. It works by uploading a malicious JSP file ('/rce.jsp') to the target server using an HTTP PUT request. The JSP payload executes the 'whoami' command on the server and returns the output, demonstrating remote code execution. The script supports scanning single or multiple targets (from a file) and uses multithreading for efficiency. The exploit disables SSL verification and suppresses related warnings for compatibility with misconfigured servers. The repository also includes a minimal README.md. No hardcoded IPs or domains are present; the user supplies targets via command-line arguments. The exploit is operational, providing a working payload and demonstrating the vulnerability.

This repository contains a Python exploit script (CVE-2024-50379.py) and a README for CVE-2024-50379, a race condition vulnerability in certain web servers that allows arbitrary file upload. The exploit works by rapidly sending concurrent HTTP PUT and GET requests to the target server, attempting to upload a malicious JSP file (webshell or arbitrary payload) and then access it. The script supports user-supplied payloads via the '-f' argument and can target a single URL or a list of URLs from a file. The exploit attempts a 6-second race condition attack first, followed by a user-specified or default 10-second attack if the first fails. If successful, the uploaded JSP file (with a random MD5-based filename) can be accessed to achieve remote code execution. The repository is structured simply, with the main exploit logic in the Python script and usage instructions in the README. The attack vector is network-based, targeting web servers via HTTP PUT/GET requests. All endpoints used for exploitation are dynamically generated per run, making detection more difficult.

This repository contains a working exploit for CVE-2024-50379, a critical remote code execution vulnerability in Apache Tomcat. The main file, CVE-2024-50379.py, is a Python script that attempts to upload a malicious JSP reverse shell to a Tomcat server by exploiting a time-of-check-to-time-of-use (TOCTOU) race condition using 500 concurrent threads. The script targets endpoints such as http://localhost:8080/shell.Jsp and http://localhost:8080/shell.jsp, attempting to bypass security checks and achieve successful upload and execution of the shell. The payload is a JSP script that, when triggered, connects back to the attacker's machine (192.168.122.150:4444) to provide a reverse shell. The README.md provides background information and context about the vulnerability and the exploit's purpose. The exploit is operational and demonstrates a real-world attack scenario against vulnerable Tomcat servers.

This repository contains a Python exploit script (exploit.py) targeting CVE-2024-50379, a vulnerability in web servers (notably Apache Tomcat or similar) that allows arbitrary file uploads to the /uploads directory. The exploit automates the process of uploading a JSP web shell (shell.jsp) to the vulnerable server via the /uploads/upload.jsp endpoint. Once uploaded, the attacker can interactively send system commands to the server by accessing /uploads/shell.jsp with the 'cmd' parameter, receiving the command output in response. The script includes logic for server reachability checks, upload retries, and a command execution loop. The payload is a standard JSP web shell capable of executing arbitrary commands. The repository is structured with a single exploit script, a README with usage instructions, and standard project files (.gitignore, LICENSE).

This repository provides a Python-based proof-of-concept exploit for CVE-2024-50379, targeting servers (notably Apache Tomcat) with insecure file upload handling. The exploit script (exploit_cve_2024_50379.py) automates the process of uploading a malicious JSP web shell to the /uploads directory of a vulnerable server via the /uploads/upload.jsp endpoint. Once uploaded, the shell (shell.jsp) can be accessed at /uploads/shell.jsp, allowing the attacker to execute arbitrary system commands through an interactive command-line interface. The script includes features such as automatic URL formatting, retry logic for uploads and command execution, and basic HTML output parsing. The repository is structured with a single exploit script, a README providing detailed usage instructions, and a license file. The exploit is operational, providing a working payload and interactive exploitation capability, but is not part of a larger exploitation framework.

This repository provides a Proof of Concept (POC) exploit for CVE-2024-50379, a TOCTOU (Time-of-Check Time-of-Use) race condition vulnerability in Apache Tomcat. The exploit targets Tomcat servers running on case-insensitive file systems (such as Windows) with misconfigured Default Servlet permissions that allow file uploads and overwrites. The repository contains two main JSP files: - 'upload.jsp': Implements a file upload handler that saves uploaded files to an 'uploads/' directory on the server. This is used to upload arbitrary JSP files. - 'hello.jsp': A sample payload JSP that, when executed, runs the command 'cmd /c start calc.exe' (demonstrating code execution on Windows). The attack involves uploading a malicious JSP file and exploiting the case-insensitive file system to overwrite an existing file, thereby achieving remote code execution. The README provides detailed exploitation steps and security considerations. No hardcoded IP addresses or network endpoints are present, but the attack is performed over HTTP(S) to the Tomcat server. The exploit is a POC and not weaponized, but demonstrates the vulnerability and its impact clearly.

This repository provides an exploit for Apache Tomcat CVE-2024-50379, a vulnerability that allows unauthenticated attackers to upload and execute arbitrary JSP files via a race condition in file handling. The main exploit script (CVE-2024-50379.py) is a Python tool that takes a target URL or a list of URLs and a payload file (upload.txt), then attempts to upload the payload as a JSP webshell to several endpoints (e.g., /asd.Jsp, /qwe.Jsp, /1.jsp, /2.jsp) using a high degree of concurrency (10,000 threads). The payload (upload.txt) is a JSP webshell that, once uploaded, can be used to write additional JSP files to the server, enabling persistent remote code execution. The README.md provides usage instructions and describes how to verify successful exploitation by checking for the presence and output of /2.jsp and /1.jsp. The repository is structured with a Python exploit script, a JSP payload, and documentation. The exploit is operational and provides a working webshell if the target is vulnerable.

This repository provides a proof-of-concept exploit for CVE-2024-50379, a TOCTOU race condition in Apache Tomcat that can lead to remote code execution if the server is misconfigured. The exploit consists of a Python script (poc.py) that uploads a malicious JSP web shell to a writable directory on the target Tomcat server via an upload handler (upload.jsp). Once uploaded, the script accesses the shell via HTTP and sends arbitrary system commands for execution. The repository includes a README with setup and usage instructions, and the exploit requires a vulnerable Tomcat instance with a writable /uploads directory and an upload handler. The main attack vector is network-based, targeting the Tomcat server's file upload functionality. The payload is a JSP web shell capable of executing arbitrary commands received via the 'cmd' parameter.

This repository contains a Python exploit script targeting Apache Tomcat servers vulnerable to CVE-2024-50379. The main file, 'ApachTomcat_CVE-2024-50379_ConditionalCompetitionToRce.py', attempts to exploit a race condition by concurrently uploading JSP files ('aa.Jsp' and 'bb.Jsp') containing a payload that executes 'calc.exe' on the server, demonstrating remote code execution. The script supports both single and batch URL testing, as described in the README. It uses a high number of threads (10,000) to increase the likelihood of successful exploitation. The endpoints '/aa.Jsp', '/bb.Jsp', '/aa.jsp', and '/bb.jsp' are used for uploading and accessing the malicious JSP files. The exploit is operational, providing a working RCE payload, and is intended for use against Tomcat servers accessible over HTTP or HTTPS.

This repository is a Proof-of-Concept (PoC) exploit for CVE-2024-50379, a race condition vulnerability in Apache Tomcat that allows remote code execution. The main exploit logic is implemented in 'main.go' using the Go programming language. The exploit works by concurrently sending a large number of HTTP PUT and GET requests to the target Tomcat server, attempting to upload a malicious JSP payload ('aa.Jsp' and 'bb.Jsp') and then trigger its execution. The payload is a JSP script that writes a webshell ('poc.jsp') to the Tomcat webapps/ROOT directory, enabling further remote code execution. The repository is structured simply, with a single Go source file, standard Go module files, and documentation. The exploit is not weaponized but serves as a functional PoC for testing the vulnerability. The only required input is the base URL of the target Tomcat server, provided via the '-u' command-line flag.