Apache Tomcat Tribes EncryptInterceptor Bypass

Repository contains a small standalone proof-of-concept for CVE-2026-34486, plus a README explaining the regression in Apache Tomcat's EncryptInterceptor. The codebase is minimal: one Python script (exploit.py) and one documentation file. The exploit is not framework-based. The Python PoC constructs a Tomcat cluster message using a simple 4-byte big-endian length prefix followed by serialized payload bytes. By default it uses a minimal Java serialization stream containing a dummy object descriptor ('ExampleMessage'), but it also supports loading arbitrary serialized bytes from a local file via the --payload argument. It then opens a TCP connection to a user-specified host and port and sends the frame directly to the Tomcat cluster receiver. Its main capability is demonstrating a network-based plaintext message injection/bypass against vulnerable Tomcat cluster nodes configured with EncryptInterceptor. It does not include post-exploitation logic, authentication bypass chaining, remote code execution primitives, or a reverse shell. It is therefore best classified as a PoC that validates the vulnerable receive path by delivering unencrypted cluster traffic that should have been rejected. Operationally, the exploit requires a reachable Tomcat cluster receiver and a vulnerable version/configuration: Apache Tomcat 11.0.20, 10.1.53, or 9.0.116 with clustering enabled and EncryptInterceptor in use. The README notes common receiver ports 4000 or 5000, though the script itself accepts any user-supplied port. The provided result is successful delivery of a crafted unencrypted cluster frame that may be accepted and forwarded by the vulnerable interceptor chain despite decryption failure.

This repository is a working proof-of-concept exploit for CVE-2026-34486, an Apache Tomcat Tribes clustering vulnerability where EncryptInterceptor fails open on decryption errors, allowing unauthenticated attackers to send unencrypted cluster messages that still reach Java deserialization code paths. The repo is small and purpose-built: GadgetGen.java generates a serialized CommonsCollections6-style gadget chain that executes an arbitrary command via Runtime.exec; send_payload.py constructs a Tomcat Tribes ChannelData packet with FLT2002/TLF2003 framing and sends the serialized object over TCP to the Tribes receiver; server.xml configures a vulnerable Tomcat cluster with EncryptInterceptor enabled and a receiver on port 4000; Dockerfile builds a reproducible Tomcat 11.0.20 lab image; and run.sh automates dependency download, payload generation, container build/start, exploit delivery, and verification. The main exploit capability is unauthenticated network-based RCE against affected Tomcat versions with Tribes clustering exposed. The included payload is operational but basic: it defaults to creating /tmp/pwned in the target container to prove code execution. The exploit path is not through HTTP but through the Tomcat Tribes cluster receiver on TCP/4000. The repository is not a scanner or detector; it is an actual exploit PoC with end-to-end reproduction steps.

This repository is a small proof-of-concept exploit lab with 3 files: a Python exploit (poc.py), a Dockerfile that builds a vulnerable Apache Tomcat test container, and a docker-compose.yml exposing ports 8080 and 4000. The main exploit is poc.py, which crafts a raw Tomcat Tribes cluster packet and sends it over TCP to an attacker-specified host and port. The exploit’s core capability is remote command execution. It embeds an attacker-provided command into a serialized Java gadget chain built from Apache Commons Collections classes (notably LazyMap, ChainedTransformer, ConstantTransformer, and InvokerTransformer) that ultimately calls Runtime.exec(). The serialized payload is split into two static byte blobs (T1 and T2), with the command length and command bytes inserted between them. The script then wraps this serialized object inside a custom Tomcat Tribes message format using hardcoded protocol markers (FLT2002/TLF2003 and TRIBES-B/TRIBES-E), a fabricated member structure, and a timestamp/UUID-like field before transmitting it over a TCP socket. The Dockerfile strongly supports the exploit’s intended target and mechanism: it uses a Tomcat 9.0.116 JDK8 image, restores default webapps, downloads commons-collections-3.2.1.jar from Maven Central into Tomcat’s lib directory, and replaces server.xml. This indicates the repository is meant to stand up a local vulnerable environment where the deserialization gadget chain is available on the classpath. docker-compose.yml publishes port 4000, which is likely the Tribes cluster listener targeted by the exploit, and 8080 for normal Tomcat HTTP access. Operationally, the exploit is straightforward: run poc.py with <host> <port> <command>, and it opens a TCP connection, sends the crafted packet, and closes the socket. There is no response parsing, shell management, staging, or payload customization beyond the supplied command, so this is best classified as an operational PoC rather than a weaponized framework module.

This repository is a small standalone exploit project with two files: a README describing the vulnerability and usage, and a Python exploit script (exp.py). The exploit targets CVE-2026-34486 in Apache Tomcat Tribes EncryptInterceptor, where failed decryption does not stop message processing, allowing raw attacker-controlled bytes to reach Java deserialization logic on the cluster receiver port. The main exploit flow in exp.py is: locate dependencies, generate a Java helper source file (TribesClient.java) from an embedded string, compile it with javac against Tomcat Tribes libraries, invoke ysoserial to build a gadget-based serialized payload, wrap that payload in a crafted Apache Tribes ChannelData/XByteBuffer frame, and send it over TCP to the target host/port. The embedded Java helper uses Tomcat classes such as ChannelData, XByteBuffer, and MemberImpl, and reflectively accesses START_DATA and END_DATA markers to construct a valid Tribes frame. Capabilities include: (1) direct one-shot command execution via -c/--command, (2) command execution with output retrieval via --rce by redirecting stdout/stderr into /usr/local/tomcat/webapps/ROOT/.out.txt and then fetching it over HTTP, and (3) an interactive shell mode that repeatedly executes commands and retrieves output. The default gadget is CommonsCollections6, with several alternate gadget choices exposed on the CLI. The exploit is operational rather than a simple PoC because it automates payload generation, helper compilation, network delivery, and output retrieval. It is not a framework module. The primary attack vector is unauthenticated network access to the Tomcat Tribes receiver, typically TCP port 4000. Secondary HTTP access to port 8080 is used only for convenience in retrieving command output after successful exploitation.

Repository contains a README and one main Bash script, cve-2026-34486-repro.sh. It is a real exploit/reproduction lab for CVE-2026-34486 affecting Apache Tomcat clustering with EncryptInterceptor. The exploit logic is network-based: it prepares two Tomcat instances, enables Tribes clustering and EncryptInterceptor, installs Commons Collections 3.1, downloads ysoserial, generates a Java deserialization gadget payload, and sends a crafted cluster message so that decryption failure does not stop downstream processing. The intended result is arbitrary command execution on the receiving Tomcat node via ObjectInputStream.readObject(), demonstrated by creation of /tmp/CVE-2026-34486-PWNED. The README explains the root cause in EncryptInterceptor.messageReceived(), affected/fixed versions, cluster topology, and expected logs. The script automates dependency installation, vulnerable Tomcat download, XML patching via embedded Python, cluster startup, payload generation, attack execution, and post-exploitation verification. Fingerprintable targets include Tomcat cluster multicast discovery at 228.0.0.4:45564, Tribes TCP ports 4000/4001, HTTP ports 18080/28080, and local file paths used for setup and success verification. Overall, this is an operational PoC/lab automation script for reproducing unauthenticated cluster-message-driven deserialization RCE in vulnerable Tomcat deployments.