dragonked2/cve-2024-50379-poc
This repository contains a Python script designed to exploit CVE-2024-50379, a vulnerability that allows attackers to upload a JSP shell to a vulnerable server and execute arbitrary commands remotely. This exploit is particularly useful when the /uploads directory is either unprotected or not present on the target server.
This repository contains a Python script designed to exploit CVE-2024-50379, a vulnerability that allows attackers to upload a JSP shell to a vulnerable server and execute arbitrary commands remotely. This exploit is particularly useful when the /uploads directory is either unprotected or missing on the target server.
CVE-2024-50379 is a vulnerability affecting servers that improperly handle file uploads, enabling an attacker to upload a JSP shell. This shell can then be used to execute arbitrary commands remotely. The provided Python script automates this process by uploading the shell to a vulnerable server and allowing interaction with the server through a command-line interface.
Before running the script, ensure that you have the following installed:
Python 3.6+ (Recommended)
requests library. Install it using pip:
pip install requests
The exploit targets systems running or similar servers that fail to properly secure their file upload functionality or have misconfigured directories.
/uploadsImportant: This tool should only be used in controlled environments such as penetration testing with permission or for educational purposes. Unauthorized use of this tool may be illegal and unethical.
http:// to URLs without a scheme./uploads Directory: If the /uploads directory is not found, the tool continues attempting the shell upload.Clone the repository to your local machine:
git clone https://github.com/dragonked2/CVE-2024-50379-POC.git
cd CVE-2024-50379-POC
Ensure you have the required Python libraries installed:
pip install requests
Run the script with the following command:
python exploit_cve_2024_50379.py
The script will prompt you to enter the base URL of the vulnerable server (e.g., http://localhost:8080). If the URL does not include http:// or https://, it will automatically add http://.
Once the JSP shell is uploaded successfully, you can interactively enter commands to execute on the server. The script will display the output.
Example interaction:
[+] Enter the base URL (e.g., localhost:8080): http://127.0.0.1:8080
[+] Checking server accessibility...
[+] /uploads directory not found (404), but continuing with upload attempt...
[+] Attempting to upload shell (Attempt 1/3)...
[+] Shell uploaded successfully! Check the URL: http://127.0.0.1:8080/uploads/shell.jsp
[+] Enter the command to execute on the server (or 'exit' to quit): whoami
[+] Executing command: whoami
[+] Command output:
root
Type exit to exit the tool after completing your interactions.
The tool includes robust error handling for common issues such as:
Failed operations will automatically be retried up to three times with a 2-second delay between attempts. If an operation fails after retries, an error message will be displayed.
Contributions are welcome! If you find bugs or have suggestions for improvements, feel free to open an issue or submit a pull request.
This tool is intended for educational and penetration testing purposes only. Do not use this tool on systems you do not own or have explicit permission to test. Unauthorized use is illegal and can result in criminal charges.
This project is licensed under the MIT License. See the LICENSE file for details.
### Explanation:
- **Headings**: Clear sections using Markdown headers (`#`, `##`, `###`) for organization.
- **Code Blocks**: Properly formatted code using triple backticks (```) for commands and script output.
- **Lists**: Bullet points and ordered lists to break down features and steps.
- **Links**: A link to the LICENSE file for easy reference.