Exploit for CVE-2018-1305

## https://sploitus.com/exploit?id=867A0A88-6A30-5C89-B732-0F71445DB7F5
# Apache Tomcat Security Bypass Vulnerability

![exploit](https://github.com/iBearcat/CVE-2018-1305/blob/master/img/tomcat.jpg?raw=true)

Recently, Apache released a security bulletin stating that multiple versions of Apache Tomcat 7, 8, and 9 have security bypass vulnerabilities. Attackers can exploit these vulnerabilities to bypass certain security restrictions and perform unauthorized operations, which may facilitate further attacks. The security constraints defined by the ServletSecurity annotation are only applied once after the servlet is loaded. Since the security constraints defined in this way apply to URL patterns and any URL under that pattern, they may depend on the order in which servlets are loaded, potentially exposing resources to unauthorized access.

## Vulnerability ID
CVE-2018-1305

## Affected Versions
Apache Tomcat < 9.0.5
Apache Tomcat < 8.5.28
Apache Tomcat < 8.0.50
Apache Tomcat < 7.0.85

## Threat Level
Medium

## Vulnerability Demonstration
Java EE provides the ServletSecurity annotation, which can be used to protect Servlets. If there are two Servlets: Servlet1, with a access path of “/servlet1/*” and a ServletSecurity annotation, and Servlet2, with an access path of “/servlet1/servlet2/*” without a ServletSecurity annotation, the first access to servlet1/servlet2 will not trigger the protection of Servlet1 due to the absence of the ServletSecurity annotation. This could lead to unauthorized access. If “/servlet1/servlet2” is accessed before “/servlet1”, Tomcat will load the ACL and start protecting “/servlet1/servlet2”, so the vulnerability will not be triggered. ![exploit](https://github.com/iBearcat/CVE-2018-1305/blob/master/img/1.jpg?raw=true)

By adding the ServletSecurity annotation before Servlet1, while Servlet2 does not have it. ![exploit](https://github.com/iBearcat/CVE-2018-1305/blob/master/img/2.jpg?raw=true)

By modifying the url-pattern of the servlet in the web.xml file as shown below. ![exploit](https://github.com/iBearcat/CVE-2018-1305/blob/master/img/3.jpg?raw=true)

Running the project. When accessing the URL of Servlet2 for the first time, unauthorized access is possible, as the ACL for Servlet1 does not take effect. http://localhost:8080/CVE-2018-1305/servlet1/servlet2/

![exploit](https://github.com/iBearcat/CVE-2018-1305/blob/master/img/4.jpg?raw=true)

When accessing the URL of Servlet1 for the second time, access is blocked, and the ACL takes effect at this point. http://localhost:8080/CVE-2018-1305/servlet1/

![exploit](https://github.com/iBearcat/CVE-2018-1305/blob/master/img/5.jpg?raw=true)

When accessing the URL of Servlet2 again, access is blocked. If the ACL for Servlet2 takes effect, it must be based on the premise that Servlet1 has been accessed before. http://localhost:8080/CVE-2018-1305/servlet1/servlet2/

![exploit](https://github.com/iBearcat/CVE-2018-1305/blob/master/img/6.jpg?raw=true)

## Vulnerability Demonstration
![exploit](https://github.com/iBearcat/CVE-2018-1305/blob/master/img/Demonstration.gif?raw=true)

Therefore, the demonstration of the vulnerability is limited to after Tomcat starts up, when “/servlet1/servlet2/*” is accessed before “/servlet1/*”. If anyone has previously accessed the “/servlet1/*” page, the vulnerability will not be triggered. The vulnerability is highly dangerous, but the conditions for exploiting it are difficult, so the impact is not significant. ## Related Links
https://vulners.com/cve/CVE-2018-1305

http://blog.nsfocus.net/cve-2018-130-handling/

https://www.anquanke.com/post/id/99213