Home / Java / Security

Apache Tomcat + MongoDB Remote Code Execution

Apache Tomcat + MongoDB Remote Code Execution

Apache-Tomcat-MongoDB-Remote-Code-Execution

0x01 Add the following JARs to /lib directory.

mongo-java-driver-3.10.2.jar
mongo-store-3.0.0.jar
Mongo-Tomcat-Sessions.jar

0x02 Modify the configuration file, conf/context.xml then start Tomcat Server and MongoDB Server.

<Valve className="com.dawsonsystems.session.MongoSessionTrackerValve"/>
<Manager className="com.dawsonsystems.session.MongoManager" 
         host="127.0.0.1" 
         port="27017" 
         database="sessions" 
         maxInactiveInterval="84"/>

0x03 Send the request with PoC, when users login again, there is Remote Code Execution.

0x04 start Tomcat Server, when users login the website, their login sessions will be stored in MongoDB Server, as you know, there are so many unauthorized MongoDB Servers on the Internet, just search them by Shodan :)

1 Open More issues
Open

Apache 8.5.39 not working.

I am trying on apache 8.5.39. Could you possibly create a docker for this vulnerability? Thanks in advance.

opened Jun 16, 2020 by PunitTailor55 0
Information
Category: Java / Security
Watchers: 4
Star: 102
Fork: 18
Last update: Jun 22, 2020

Contents
    Resource links
    https://github.com/pyn3rd/Apache-Tomcat-MongoDB-Remote-Code-Execution
    Share this repo
    Most popular
    google Tink is a multi-language, cross-platform, open source library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.
    cryptomator Multi-platform transparent client-side encryption of your files in the cloud
    auth0 Java implementation of JSON Web Token (JWT)
    bisq-network A decentralized bitcoin exchange network
    apache Apache Shiro
    google Project Wycheproof tests crypto libraries against known attacks.
    pac4j Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
    baidu 🔥Open source RASP solution
    bcgit Bouncy Castle Java Distribution (Mirror)
    casbin An authorization library that supports access control models like ACL, RBAC, ABAC in Java

    Related Repos


    Security
    29
    Geolocation for SSH brute force attacks
    ludovicianul geolog IP geolocation for SSH brute force attacks. features continuous ssh auth log parsing for failed login attempts notify successful attempts via email as potetial breaches basic charts with the origin count
     
    Security
    866
    Conscrypt is a Java Security Provider that implements parts of the Java Cryptography Exten...
    google Conscrypt - A Java Security Provider Conscrypt is a Java Security Provider (JSP) that implements parts of the Java Cryptography Extension (JCE) and Java Secure Socket Extension (JSSE). It uses BoringSSL to provide cryptograhpic p
     
    Security
    2.3k
    Project Wycheproof tests crypto libraries against known attacks.
    google Project Wycheproof https://github.com/google/wycheproof Project Wycheproof is named after Mount Wycheproof, the smallest mountain in the world. The main motivation for the project is to have a goal that is achievable. The smalle
     
    Security
    0
    An open source web application firewall component
    zhuinfo seawaf-agent An open source web application firewall component why Applications should not be delegating most of their runtime protection to the external devices. Applica-tions should be capable of self- protection
     
    Popular
    Security
    11.1k
    Tink is a multi-language, cross-platform, open source library that provides cryptographic ...
    google Tink A multi-language, cross-platform library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse. Ubuntu macOS Index In
     
    Popular
    Security
    3.4k
    A decentralized bitcoin exchange network
    bisq-network Bisq What is Bisq? Bisq is a safe, private and decentralized way to exchange bitcoin for national currencies and other digital assets. Bisq uses peer-to-peer networking and multi-signature escrow to facilitate tradin
     
    Security
    1.7k
    🔥Open source RASP solution
    baidu OpenRASP Introduction Unlike perimeter control solutions like WAF, OpenRASP directly integrates its protection engine into the application server by instrumentation. It can monitor various events including database
     
    Security
    1.3k
    An authorization library that supports access control models like ACL, RBAC, ABAC in Java
    casbin jCasbin News: still worry about how to write the correct jCasbin policy? Casbin online editor is coming to help! Try it at: http://casbin.org/editor/ jCasbin is a powerful and efficient open-source access control librar