CVE-2024-50379 PoC — Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

Title:Apache Tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)
Description:Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

RCE through a race condition in Apache Tomcat

# Tomcat-CVE-2024-50379-Poc

![Language](https://img.shields.io/badge/language-golang-blue.svg)

> [!IMPORTANT]
> 仅供学习交流使用，请勿用于非法用途

RCE through a race condition in Apache Tomcat

reference: https://github.com/iSee857/CVE-2024-50379-PoC

# Demo

![](./demo.gif)

# Usage

```bash
go run main.go -u http://localhost:8080/
```

# Todo

- [ ] 漏洞利用成功的检测机制

 [4.0K]  /data/pocs/8281309bc484b6386f2f8a27a6aadc568fc35ad3
├── [ 18M]  demo.gif
├── [  33]  go.mod
├── [   0]  go.sum
├── [1.0K]  LICENSE
├── [2.6K]  main.go
└── [ 407]  README.md

0 directories, 6 files