CVE-2009-3548
Apache Tomcat 5.5.0-5.5.28 and 6.0.0-6.0.20 - Unauthenticated Privilege Escalation via Default Blank Admin Password
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2009-3548.
PoCs published by Metasploit, MC, jduck, including Metasploit module auxiliary/scanner/http/tomcat_mgr_login.
AI-analyzed exploit summary This Metasploit module exploits Apache Tomcat Manager's authenticated file upload functionality to deploy a malicious WAR archive containing a JSP payload, achieving remote code execution. It handles CSRF tokens and session management to bypass protections.
Description
The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Exploits (5)
This Metasploit module exploits Apache Tomcat Manager's authenticated file upload functionality to deploy a malicious WAR archive containing a JSP payload, achieving remote code execution. It handles CSRF tokens and session management to bypass protections.
This Metasploit module attempts to brute-force login credentials for the Tomcat Application Manager by testing various default or weak credentials. It does not exploit a vulnerability but scans for weak authentication configurations.
This Metasploit module exploits Apache Tomcat's manager application to upload and execute a malicious WAR file, leveraging authenticated access. It handles CSRF tokens, platform detection, and payload deployment/cleanup.
This Metasploit module exploits CVE-2009-3548 by deploying a malicious WAR file to an Apache Tomcat server via the exposed manager application, achieving authenticated remote code execution. It supports multiple platforms and architectures, and includes functionality for automatic target detection.
This Metasploit module exploits Apache Tomcat's Manager application by uploading a malicious WAR archive containing a JSP payload via PUT request, achieving authenticated remote code execution. It supports automatic target detection and cleanup by undeploying the malicious application post-exploitation.