支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: 49001190fafd078a0170b0d219aebec5a2e183ac

来源
https://github.com/TAM-K592/CVE-2024-52318
关联漏洞
标题:Apache Tomcat 安全漏洞 (CVE-2024-52318)
Description:Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。 Apache Tomcat存在安全漏洞，该漏洞源于存在不正确的对象回收和重用漏洞。
Description
CVE-2024-52318 - Apache Tomcat XSS Vulnerability in Generated JSPs
介绍
# CVE-2024-52318
🚨🚨CVE-2024-52318 - Apache Tomcat XSS Vulnerability in Generated JSPs🚨🚨

 Overview

CVE-2024-52318 is a crosssite scripting (XSS) vulnerability in Apache Tomcat, which arises from improperly released resources in generated JavaServer Pages (JSPs). This issue, introduced by a prior improvement (fix 69333), causes some JSP tags to fail in escaping output as expected. This can allow attackers to inject malicious scripts into web pages, potentially compromising user data or hijacking user sessions.



 Affected Versions

The following versions of Apache Tomcat are vulnerable:

Version Series	Affected Versions
Apache Tomcat 11.0	Versions prior to 11.0.1
Apache Tomcat 10.1	Versions prior to 10.1.33
Apache Tomcat 9.0	Versions prior to 9.0.97




 Exploitability

 Attack Vector

 How the Exploit Works:  
  Attackers can exploit this vulnerability by injecting malicious payloads into vulnerable JSPs. The failure to properly escape output may result in the execution of injected scripts when users access the affected pages.

 Potential Impact:
   Theft of sensitive user information, such as cookies and session tokens.
   Execution of unauthorized actions in the context of a user's session (e.g., CSRF attacks).
   Disruption of data integrity and overall system security.



 Mitigation

 Upgrade

To resolve this vulnerability, upgrade to a patched version of Apache Tomcat:

 Apache Tomcat 11.0.1 or later.
 Apache Tomcat 10.1.33 or later.
 Apache Tomcat 9.0.97 or later.

 Best Practices for JSP Development

1. Ensure all JSP outputs are explicitly escaped to prevent XSS vulnerabilities.
2. Regularly review and audit JSP configurations and tag library usage.
3. Implement a Content Security Policy (CSP) to mitigate the impact of any injected scripts.



 References

 [Apache Tomcat Security Advisory for CVE202452318](https://tomcat.apache.org/security11.html)
 
 [Apache Mailing List Discussion](https://lists.apache.org/thread/dz6nv1j2mm1m3hqfxdtt392qlo7xf6z0)
 
 [Apache Tomcat Downloads](https://tomcat.apache.org/download11.cgi)
文件快照

 [4.0K]  /data/pocs/49001190fafd078a0170b0d219aebec5a2e183ac
├── [3.2K]  CVE-2024-52318.py
└── [2.0K]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。