Home / Java / Security

Apache Tomcat + MongoDB Remote Code Execution

Apache Tomcat + MongoDB Remote Code Execution
Information
Category: Java / Security
Watchers: 4
Star: 102
Fork: 18
Last update: Jun 21, 2020
Resource links
https://github.com/pyn3rd/Apache-Tomcat-MongoDB-Remote-Code-Execution

Apache-Tomcat-MongoDB-Remote-Code-Execution

0x01 Add the following JARs to /lib directory.

mongo-java-driver-3.10.2.jar
mongo-store-3.0.0.jar
Mongo-Tomcat-Sessions.jar

0x02 Modify the configuration file, conf/context.xml then start Tomcat Server and MongoDB Server.

<Valve className="com.dawsonsystems.session.MongoSessionTrackerValve"/>
<Manager className="com.dawsonsystems.session.MongoManager" 
         host="127.0.0.1" 
         port="27017" 
         database="sessions" 
         maxInactiveInterval="84"/>

0x03 Send the request with PoC, when users login again, there is Remote Code Execution.

0x04 start Tomcat Server, when users login the website, their login sessions will be stored in MongoDB Server, as you know, there are so many unauthorized MongoDB Servers on the Internet, just search them by Shodan :)

1 Open More issues
Open

Apache 8.5.39 not working.

I am trying on apache 8.5.39. Could you possibly create a docker for this vulnerability? Thanks in advance.

opened Jun 16, 2020 by PunitTailor55 0

Contents

    sebdah MongoDB pipeline for Scrapy. This module supports both MongoDB in standalone setups and replica sets. scrapy-mongodb will insert the items to MongoDB as soon as your spider finds data to extract.
    RedTeamPentesting Exploit for WebSocket Vulnerability in Apache Tomcat
    nilportugues [PHP 7] MongoDB Repository implementation
    paulonteri Remote Code Execution system built with NodeJS and ReactJS
    apache Mirror of Apache Bahir
    newrelic-experimental Per CVE-2021-44228 and CVE-2021-45046, Apache log4j2 versions < 2.16.0 (except 2.12.2) are vulnerable to remote code execution and potential data exfiltration.
    UnderGreen Ansible role to configure MongoDB
    loresoft MongoDB Messaging Library
    Plazmaz A honeypot proxy for mongodb. When run, this will proxy and log all traffic to a dummy mongodb server.
    Microsoft Visual Studio Code Remote Development: Open any folder in WSL, in a Docker container, or on a remote machine using SSH and take advantage of VS Code's full feature set.
    Narasimha1997 Simulating Log4j Remote Code Execution (RCE) vulnerability in a flask web server using python's logging library with custom formatter that simulates lookup substitution by executing remote exploit code.
    34zY CVE-2021-40444 - Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit
    dotnet .NET for Apache® Spark™ makes Apache Spark™ easily accessible to .NET developers.
    Tencent Firestorm is a Remote Shuffle Service, and provides the capability for Apache Spark applications to store shuffle data on remote servers
    django-nonrel Django MongoDB Backend
    minhajuddin A mongodb rest client written as an Nginx module
    mongolab Manage MongoDB servers and replica sets using JSON configurations!
    Stratio Spark library for easy MongoDB access
    puentesarrin MongoDB Python logging handler, Centralized logging made simple using MongoDB.
    nilportugues Eloquent MongoDB Repository Implementation
    yonderblue Java message queue using MongoDB as a backend
    Share this repo

    Related Repos


    Security
    7
    JavaPassDump
    corener JavaPassDump 背景： 红队实战中，有遇到数据库的配置信息加密的情况，有些甚至在Native层处理加解密，为简化红队流程，产生一个通用的数据库信息提取工具：JavaPassDump。
     
    Security
    14
    Avoid the NEXT Log4Shell vulnerability!
    gredler A Java agent that disables features you don't use, before an attacker uses them against you.
     
    Security
    4
    JNDIExploit v1.2
    IR0DayToday # JNDIExploit JNDIExploit v1.2 JNDIExploit v1.2 here can u downoad direct from this git Direct Download for linux wget https://download1320.mediafire
     
    Security
    191
    Burpsuite extension for log4j2rce
    tangxiaofeng7 BurpLog4j2Scan Description BurpLog4j2Scan is a Burp Suite Extension written in JAVA which could be useful as scan log4j2rce. Screenshot start scan pro
     
    Security
    845
    SonarSource Static Analyzer for Java Code Quality and Security
    SonarSource Code Quality and Security for Java This SonarSource project is a code analyzer for Java projects. Information about the analysis of Java features is a
     
    Security
    280
    Log4j2 RCE Passive Scanner plugin for BurpSuite
    whwlsfb Log4j2 RCE Passive Scanner plugin for BurpSuite
     
    Security
    2.1k
    Log4j impact manufacturers and components summary from the Internet community
    YfryTchsGD Log4j impact manufacturers and components summary from the Internet community. Welcome everyone to submit mr to perfect the possible influence surface.
     
    Security
    993
    Spring Boot web application vulnerable to CVE-2021-44228, nicknamed Log4Shell.
    christophetd Spring Boot web application vulnerable to CVE-2021-44228, nicknamed Log4Shell.
     
    Security
    38
    A automatic bypass 403 Burpsuite plugin
    p0desta AutoBypass403-BurpSuite A burpsuite plugin help me automatic bypass 403. ChangeLog 2021-12-04 support multi-threaded concurrency 2021-12-02 First publ
     
    Security
    219
    Password strength estimator
    GoSimpleLLC Nbvcxz - Password strength estimator - [] nbvcxz is java library (and standalone console program) which is heavily inspired by the work in zxcvbn. Pas
     
    Security
    3
    Keeps LetsEncrypt certificates up-to-date for your Spring Boot Web application
    valb3r Keeps LetsEncrypt certificates up-to-date for your Spring Boot Web application. Pure Java in a single file of library code. An automated embedded alternative to Certbot and docker-sidecars. No JVM restart is needed on certificate update.
     
    Security
    1.1k
    This project aims to deobfuscate most commercially-available obfuscators for Java.
    java-deobfuscator This project aims to deobfuscate most commercially-available obfuscators for Java.
     
    Security
    1.3k
    CFR - Another Java Decompiler \o/
    leibnitz27 This is the public repository for the CFR Java decompiler
     
    Security
    31
    Test-Driven Security
    eleftherias Test-Driven Security Run tests ./gradlew test References Spring Security test support https://docs.spring.io/spring-security/site/docs/current/referen
     
    Security
    255
    FIDO2(WebAuthn) server officially certified by FIDO Alliance and Relying Party examples.
    line FIDO (Fast IDentity Online) is an open standard for online authentication. It is designed to solve the password problems stemming from a lot of security problems as we are suffering today.