PT-2009-6068 · Microsoft+2 · Windows+2

Stephen Fewer · Published 2009-11-24 · Updated 2017-08-17 · CVE-2009-3843

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Operations Manager version 8.10 on Windows

Description The issue allows remote attackers to conduct unrestricted file upload attacks and execute arbitrary code by utilizing the org.apache.catalina.manager.HTMLManagerServlet class to make requests to "manager/html/upload". This is made possible by a "hidden account" in the XML file that specifies Tomcat users.

Recommendations For HP Operations Manager version 8.10 on Windows, consider disabling the org.apache.catalina.manager.HTMLManagerServlet class as a temporary workaround until a patch is available. Restrict access to the manager/html/upload endpoint to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-3843

Affected Products

Apache Tomcat

Hp Operations Manager

Windows

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16317 · Exploit
• http://secunia.com/advisories/37444 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=125873415424980&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3843 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54361 · Note
• http://securitytracker.com/id?1023222 · Note
• http://osvdb.org/60317 · Note
• http://zerodayinitiative.com/advisories/ZDI-09-085 · Note