Nuclei-Template-CVE-2024-50379

Description

This Nuclei template detects Apache Tomcat servers vulnerable to the TOCTOU race condition that allows remote code execution (RCE).

⚠ Important note: This template should be used exclusively for educational purposes and in controlled environments with explicit consent from the system owner. Additionally, the template is in testing phase, so it has not been 100% tested with all vulnerable versions of Apache.

Requirements

• Nuclei installed, Linux, Mac, Windows.
• Authorized access to the system or network where you will perform the test.

Usage

• Modify the template:
• Open the template file and adjust the endpoint of the upload.jsp file to match the target system. Look for these lines in the YAML file:

POST /uploads/upload.jsp HTTP/1.1 Host: {{Hostname}}

Replace /uploads/upload.jsp with the actual endpoint to test.

Execute the template: Use the following command to run Nuclei with this template:

nuclei -u <TARGET_URL> -t CVE-2024-50379.yaml

For example:

nuclei -u http://example.com -t CVE-2024-50379.yaml

Results: Review the logs to identify potentially vulnerable systems. If the system is vulnerable, the template will detect responses indicating the malicious file was successfully executed.

Policies and Responsibilities

• Ethical Use: This template must only be used with explicit consent from the system owner or in lab environments. No Liability: The author is not responsible for the misuse of this template. Education and Controlled Testing: Its purpose is to educate cybersecurity professionals on vulnerability detection.

If you have questions, open an issue in this repository or contact me directly at [email protected]