Tomcat CGI Attacks
The
enableCmdLineArgumentssetting for Apache Tomcat's CGI Servlet controls whether command line arguments are created from the query stringIf set to true,
the CGI Servlet parses the query string and passes it to the CGI script as arguments.
The CGI script can use command line arguments to switch between these actions. For instance, the script can be called with the following URL:
Here, the
actionparameter is set totitle, indicating that the script should search by book title. Thequeryparameter specifies the search term "the great gatsby."If the user wants to search by author, they can use a similar URL:
However, a problem arises when
enableCmdLineArgumentsis enabled on Windows systems because the CGI Servlet fails to properly validate the input from the web browser before passing it to the CGI script.This can lead to an operating system command injection attack, which allows an attacker to execute arbitrary commands on the target system by injecting them into another command.
For instance, an attacker can append
dirto a valid command using&as a separator to executediron a Windows systemIf the attacker controls the input to a CGI script that uses this command, they can inject their own commands after
&to execute any command on the server.An example of this is
http://example.com/cgi-bin/hello.bat?&dir, which passes&diras an argument tohello.batand executesdiron the server.As a result, an attacker can exploit the input validation error of the CGI Servlet to run any command on the server.
Enumeration
Scan the target using
nmap, this will help to pinpoint active services currently operating on the system.This process will provide valuable insights into the target, discovering what services, and potentially which specific versions are running, allowing for a better understanding of its infrastructure and potential vulnerabilities.
Finding a CGI script
One way to uncover web server content is by utilising the
ffufweb enumeration tool along with thedirb common.txtwordlist.Knowing that the default directory for CGI scripts is
/cgi, either through prior knowledge or by researching the vulnerability, we can use the URLhttp://10.129.204.227:8080/cgi/FUZZ.cmdorhttp://10.129.204.227:8080/cgi/FUZZ.batto perform fuzzing.
Fuzzing Extentions - .CMD
Fuzzing Extentions - .BAT
Exploitation
we can exploit
CVE-2019-0232by appending our own commands through the use of the batch command separator&.We now have a valid CGI script path discovered during the enumeration at
http://10.129.204.227:8080/cgi/welcome.bat
Navigating to the above URL returns the output for the
dirbatch command, however trying to run other common windows command line apps, such aswhoamidoesn't return an output.Retrieve a list of environmental variables by calling the
setcommand
From the list, we can see that the
PATHvariable has been unset, so we will need to hardcode paths in requests:
The attempt was unsuccessful, and Tomcat responded with an error message indicating that an invalid character had been encountered.
Apache Tomcat introduced a patch that utilises a regular expression to prevent the use of special characters.
However, the filter can be bypassed by URL-encoding the payload.
Last updated