CVE-2023-41080 PoC — Apache Tomcat: Open redirect with FORM authentication

Source

https://github.com/shiomiyan/CVE-2023-41080

Associated Vulnerability

Title:Apache Tomcat: Open redirect with FORM authentication (CVE-2023-41080)
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.

Readme

- vulnerable: http://localhost:8081//secret.html;@example.com
    - Redirect to arbitrary web site (in this case, https://example.com).
- patched: http://localhost:8082//secret.html;@example.com

ref: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →