CVE-2024-50379

Summary

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

• CVE-2024-50379Research

  Technical analysis of Apache Tomcat CVE-2024-50379, covering root cause, exploitation conditions, detection strategies, and mitigation techniques.

• CVE-2024-50379-POCExploit

  This repository contains a Python script designed to exploit CVE-2024-50379, a vulnerability that allows attackers to upload a JSP shell to a vulnerable server and execute arbitrary commands remotely. This exploit is particularly useful when the /uploads directory is either unprotected or not present on the target server.

• CVE-2024-50379Exploit

  tomcat CVE-2024-50379/CVE-2024-56337 条件竞争文件上传exp

• CVE-2024-50379-POCPoC

  Proof-of-concept exploit for CVE-2024-50379, a TOCTOU race condition in Apache Tomcat leading to remote code execution on case-insensitive file systems.

• CVE-2024-50379-POCPoC

  Proof-of-concept exploit for CVE-2024-50379, a TOCTOU race condition in Apache Tomcat leading to remote code execution on case-insensitive file systems.

• CVE-2024-50379PoC

  CVE-2024-50379 is a critical vulnerability affecting multiple versions of Apache Tomcat, an open source web server and servlet container widely used for deploying Java-based web applications. The vulnerability arises from a Time-of-Use (TOCTOU) race condition that occurs when compiling JavaServer Pages (JSPs).

• CVE-2024-50379Exploit

  Exploit script for CVE-2024-50379, automating JSP webshell upload and execution via a race condition in Apache Tomcat.

• CVE-2024-50379-nucleiPoC

  Testing the latset Apache Tomcat CVE-2024-50379 Vuln

• CVE-2024-50379-PoCPoC

  Batch detection script for Apache Tomcat CVE-2024-50379 race condition remote code execution vulnerability. Supports single and mass scanning via Python.

• Nuclei-Template-CVE-2024-50379Scanner

  Repositorio para alojar un template de Nuclei para probar el CVE-2024-50379 (en fase de prueba)

• CVE-2024-50379-expExploit

  CVE-2024-50379-exp

• Tomcat-CVE-2024-50379-PocExploit

  RCE through a race condition in Apache Tomcat

• CVE-2024-50379Research

  Detailed technical analysis of CVE-2024-50379 (Apache Tomcat RCE) including exploitation methods, Proof of Concept (PoC), and mitigation strategies for educational and research purposes.