Exploit for HP Performance Manager Apache Tomcat Policy Bypass

CVE-2009-3548

saint · 2010-11-05

Description

HP Performance Manager Apache Tomcat Policy Bypass vulnerability. Unauthorized file upload allows remote code execution

Affected Apache Tomcat versions

Apache Tomcat= 3.0, 3.1, 3.1.1, 3.2, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.3, 3.3.1, 3.3.1a, 3.3.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.1.8, 4.1.9, 4.1.10, 4.1.11, 4.1.12, 4.1.13, 4.1.14, 4.1.15, 4.1.16, 4.1.17, 4.1.18, 4.1.19, 4.1.20

All known vulnerabilities by product

Apache Tomcat Hp-Ux

CVSS 7.5 for CVE-2009-3548

7.5

HIGH SEVERITY

VectorAV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/

EPSS Score

79.0%higher than 99.5% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2010-11-05 00:00

Last Seen:2016-10-03 15:01

Reporter:SAINT Corporation

Other exploits for CVE-2009-3548

Apache Tomcat Manager - Application Upload (Authenticated) Code Execution (Metasploit)

2014-02-05 MetasploitEXPLOITDBRuby

Apache Tomcat Manager Code Execution Exploit

2014-02-04 metasploitZDTRuby

Apache Tomcat Manager Code Execution

2014-02-01 rangerchaPACKETSTORMRuby

Apache Tomcat Manager Authenticated Upload Code Execution

2014-01-30 rangerchaMETASPLOITRuby

Tomcat Application Manager Login Utility

2013-10-21 MC <mc@metasploit.com>, Matteo Cantoni <goony@nothink.org>, jduck <jduck@metasploit.com>METASPLOITRuby

Apache Tomcat Manager Application Deployer Authenticated Code Execution

2013-01-31 jduck <jduck@metasploit.com>METASPLOITRuby

Apache Tomcat Manager - Application Deployer (Authenticated) Code Execution (Metasploit)

2010-12-14 MetasploitEXPLOITDBRuby

HP Performance Manager Apache Tomcat Policy Bypass

2010-11-05 SAINT CorporationSAINT

Exploit Code

MARKDOWN33 lines

## https://sploitus.com/exploit?id=SAINT:9E88983E6D2E3F9BD58C6DCB531A7E97
Added: 11/05/2010  
CVE: [CVE-2009-3548](<https://vulners.com/cve/CVE-2009-3548>)  
BID: [36954](<http://www.securityfocus.com/bid/36954>)  
OSVDB: [60176](<http://www.osvdb.org/60176>)  


### Background

HP Performance Manager Software is a web-based analysis and visualization tool that analyzes performance trends of applications, systems, and services. HP Performance Manager incorporates Apache Tomcat 5 to help serve custom web applications. 

### Problem

An unauthorized file upload vulnerability exists in HP Performance Manager. HP Performance Manager generates credentials for a default user/password combination in Apache Tomcat. A remote attacker can leverage this vulnerability by sending a crafted HTTP request using the default credentials. Once authenticated, the attacker can upload a malicious web application to a vulnerable system. 

### Resolution

Apply the fix referenced in [HP Security Bulletin HPSBMA02535](<http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02181353>). 

### References

<http://secunia.com/advisories/39847/>  


### Limitations

Exploit works on HP Performance Manager 8.1 on Microsoft Windows Server 2003 and Windows Server 2008. 

It may take longer than usual to establish the connection after successful exploitation because it takes time for the affected server to deploy the malicious WAR file. 

### Platforms

Windows

Exploit Code

Share

Share on social media: