PT-2019-3927 · Apache · Apache Tomcat

Publicado 2019-04-12 · Atualizado 2023-12-08 · CVE-2019-0232

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 9.0.0.M1 through 9.0.17 Apache Tomcat versions 8.5.0 through 8.5.39 Apache Tomcat versions 7.0.0 through 7.0.93

Description The issue is related to the CGI Servlet in Apache Tomcat, which is vulnerable to Remote Code Execution when running on Windows with the enableCmdLineArguments option enabled. This is due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default, and the enableCmdLineArguments option is also disabled by default in Tomcat 9.0.x. The vulnerability can be exploited by a remote attacker to execute arbitrary code due to insufficient input validation.

Recommendations For Apache Tomcat versions 9.0.0.M1 through 9.0.17, consider disabling the CGI Servlet or the enableCmdLineArguments option as a temporary workaround. For Apache Tomcat versions 8.5.0 through 8.5.39, consider disabling the CGI Servlet or the enableCmdLineArguments option as a temporary workaround. For Apache Tomcat versions 7.0.0 through 7.0.93, consider disabling the CGI Servlet or the enableCmdLineArguments option as a temporary workaround. As a general mitigation measure, restrict access to the CGI Servlet to minimize the risk of exploitation.

Exploit

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

CWE-20

Identificadores relacionados

BDU:2019-04405

CVE-2019-0232

GHSA-8VMX-QMCH-MPQG

RHSA-2019:3929

Produtos afetados

Apache Tomcat

Referências · 76

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb · Exploit
• 🔥 https://github.com/pyn3rd/CVE-2019-0232 · Exploit
• 🔥 https://github.com/jas502n/CVE-2019-0232 · Exploit
• 🔥 https://github.com/jaiguptanick/CVE-2019-0232 · Exploit
• 🔥 https://github.com/setrus/CVE-2019-0232 · Exploit
• 🔥 https://github.com/CherishHair/CVE-2019-0232-EXP · Exploit
• 🔥 https://github.com/cyy95/CVE-2019-0232-EXP · Exploit
• 🔥 https://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat · Exploit
• 🔥 https://packetstormsecurity.com/files/153506/Apache-Tomcat-CGIServlet-enableCmdLineArguments-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/47073 · Exploit
• https://github.com/apache/tomcat · Nota
• http://securityfocus.com/bid/107906 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-0232 · Nota de Segurança
• https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · Nota
• https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way · Nota