关联漏洞
标题：
Apache Tomcat 安全漏洞
(CVE-2024-52316)
描述：Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。 Apache Tomcat存在安全漏洞，该漏洞源于存在未检查的错误条件漏洞，可能会在身份验证过程中抛出异常，从而允许用户绕过身份验证过程。
介绍
# CVE-2024-52316: Unchecked Error Condition (CWE-391)
## Overview
A vulnerability was found in Apache Tomcat up to 9.0.95/10.1.30/11.0.0-M26 . It is rated critical. This affects an unknown functionality of the ServerAuthContext Component . By manipulating with an unknown input, a remote code execution vulnerability can be exploited. CWE defines the problem as CWE-391 .
## Details
+ **CVE ID:** CVE-2024-52316
+ **Published:** 2024-11-18
+ **Impact:** Critical
+ **Exploit Availability:** Not public, only private.
+ **CVSS:** 9.8
## Vulnerability Description
Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process.
## Affected Versions
**Apache Tomcat 11.0.0-M1 to 11.0.0-M26**
**Apache Tomcat 10.1.0-M1 to 10.1.30**
**Apache Tomcat 9.0.0-M1 to 9.0.95**
## Usage
```
python CVE-2024-52316.py -h 10.10.10.10 -c 'uname -a'
```
## Contact
For inquiries, please contact famixcm@thesecure.biz
## Exploit
**[Download](bit.ly/4fRxv1Y)**
文件快照
[4.0K] /data/pocs/7cb0081b069e6cc53c57fd431b20d33f1ab7dd9a
└── [1.2K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。