Sploitus

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat

CVE-2024-50379

githubexploit · 2024-12-23

Exploit Code

README14 lines
## https://sploitus.com/exploit?id=2666ADB9-9A8B-59E9-85B8-22B7F336AE7E
# CVE-2024-50379 
CVE-2024-50379 exploitation 

The `CVE-2024-50379.py` file and `upload.txt` are in the same directory. 
The content of `upload.txt` is “”. 
The content of `upload.txt` is used to generate a `2.jsp` file. 
It can be used to create a copy of the original “” version of `4.jsp`. 
Try accessing `2.jsp` to create a copy of `4.jsp`. If this doesn’t work, try accessing `1.jsp` instead. If that also fails, re-run the script. 
URL: http://192.168.36.148:8080/2.jsp 
Check if a response like “success” is returned from `2.jsp`. 

If this file exists but returns nothing, it means there’s definitely a vulnerability. During concurrent processing, the file might be overwritten, but the data isn’t written. Try accessing `1.jsp`; if that also fails, re-run the script. 
URL: http://192.168.36.148:8080/1.jsp