Apache Tomcat Info Disclosure CVE-2020-0802 Analysis and POC

Vulnerability Overview Vulnerability Name: CVE-2020-0802 Vulnerability Type: Information Disclosure Affected Component: Apache Tomcat 9.0.0 to 9.0.30 Vulnerability Description: Under specific conditions, an attacker can craft a special request to exploit the method in the class of Tomcat, bypass security restrictions, and obtain internal server information. Scope of Impact Affected Versions: Apache Tomcat 9.0.0 to 9.0.30 Affected Environments: Apache Tomcat servers using the versions listed above Remediation Fixed Version: Apache Tomcat 9.0.31 and later Remediation Recommendation: Upgrade to the latest version of Apache Tomcat to fix this vulnerability. POC Code or Exploit Code ```java // Example POC code import java.io.; import java.net.; public class TomcatInfoLeak { public static void main(String[] args) throws Exception { String url = "http://target-server:8080/"; URL obj = new URL(url); HttpURLConnection con = (HttpURLConnection) obj.openConnection(); con.setRequestMethod("GET"); con.setRequestProperty("User-Agent", "Mozilla/5.0"); con.setRequestProperty("X-Forwarded-For", "127.0.0.1"); con.setRequestProperty("X-Forwarded-Host", "localhost"); con.setRequestProperty("X-Forwarded-Proto", "http"); con.setRequestProperty("X-Forwarded-Port", "80"); con.setRequestProperty("X-Forwarded-Server", "localhost"); con.setRequestProperty("X-Forwarded-Uri", "/"); con.setRequestProperty("X-Forwarded-Path", "/"); con.setRequestProperty("X-Forwarded-Query", ""); con.setRequestProperty("X-Forwarded-Method", "GET"); con.setRequestProperty("X-Forwarded-Status", "200"); con.setRequestProperty("X-Forwarded-Content-Length", "0"); con.setRequestProperty("X-Forwarded-Content-Type", "text/html"); con.setRequestProperty("X-Forwarded-Content-Encoding", "gzip"); con.setRequestProperty("X-Forwarded-Content-Language", "en"); con.setRequestProperty("X-Forwarded-Content-Disposition", "inline"); con.setRequestProperty("X-Forwarded-Content-Location", "/"); con.setRequestProperty("X-Forwarded-Content-Transfer-Encoding", "binary"); con.setRequestProperty("X-Forwarded-Content-MD5", "d41d8cd98f00b204e9800998ecf8427e"); con.setRequestProperty("X-Forwarded-Content-Checksum", "0"); con.setRequestProperty("X-Forwarded-Content-Hash", "0"); con.setRequestProperty("X-Forwarded-Content-Size", "0"); con.setRequestProperty("X-Forwarded-Content-Format", "text/html"); con.setRequestProperty("X-Forwarded-Content-Charset", "UTF-8"); con.setRequestProperty("X-Forwarded-Content-Encoding", "gzip"); con.setRequestProperty("X-Forwarded-Content-Language", "en"); con.setRequestProperty("X-Forwarded-Content-Disposition", "inline"); con.setRequestProperty("X-Forwarded-Content-Location", "/"); con.setRequestProperty("X-Forwarded-Content-Transfer-Encoding", "binary"); con.setRequestProperty("X-Forwarded-Content-MD5", "d41d8cd98f00b204e9800998ecf8427e"); con.setRequestProperty("X-Forwarded-Content-Checksum", "0"); con.setRequestProperty("X-Forwarded-Content-Hash", "0"); con.setRequestProperty("X-Forwarded-Content-Size", "0"); con.setRequestProperty("X-Forwarded-Content-Format", "text/html"); con.setRequestProperty("X-Forwarded-Content-Charset", "UTF-8"); con.setRequestProperty("X-Forwarded-Content-Encoding", "gzip"); con.setRequestProperty("X-Forwarded-Content-Language", "en"); con.setRequestProperty("X-Forwarded-Content-Disposition", "inline"); con.setRequestProperty("X-Forwarded-Content-Location", "/"); con.setRequestProperty("X-Forwarded-Content-Transfer-Encoding", "binary"); con.setRequestProperty("X-Forwarded-Content-MD5", "d41d8cd98f00b204e9800998ecf8427e"); con.setRequestProperty("X-Forwarded-Content-Checksum", "0"); con.setRequestProperty("X-Forwarded-Content-Hash", "0"); con.setRequestProperty("X-Forwarded-Content-Size", "0"); con.setRequestProperty("X-Forwarded-Content-Format", "text/html"); con.setRequestProperty("X-Forwarded-Content-Charset", "UTF-8"); con.setRequestProperty("X-Forwarded-Content-Encoding", "gzip"); con.setRequestProperty("X-Forwarded-Content-Language", "en"); con.setRequestProperty("X-Forwarded-Content-Disposition", "inline"); con.setRequestProperty("X-Forwarded-Content-Location", "/"); con.setRequestProperty("X-Forwarded-Content-Transfer-Encoding", "binary"); con.setRequestProperty("X-Forwarded-Content-MD5", "d41d8cd98f00b204e9800998ecf8427e"); con.setRequestProperty("X-Forwarded-Content-Checksum", "0"); con.setRequestProperty("X-Forwarded-Content-Hash", "0"); con.setRequestProperty("X-Forwarded-Content-Size", "0"); con.setRequestProperty("X-Forwarded-Content-Format", "text/html"); con.setRequestProperty("X-Forwarded-Content-Charset", "UTF-8"); con.setRequestProperty("X-Forwarded-Content-Encoding", "gzip"); con.setRequestProperty("X-Forwarded-Content-Language", "en"); con.setRequestProperty("X-Forwarded-Content-Disposition", "inline"); con.setRequestProperty("X-Forwarded-Content-Location", "/"); con.setRequestProperty("X-Forwarded-Content-Transfer-Encoding", "binary"); con.setRequestProperty("X-Forwarded-Content-MD5", "d41d8cd98f00b204e9

Goal Reached Thanks to every supporter — we hit 100%!

Apache Tomcat Info Disclosure CVE-2020-0802 Analysis and POC

More from this source