CVE-2009-3843

HP Operations Manager 8.10 - Unauthenticated Remote Code Execution via Tomcat Manager Upload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2009-3843. PoCs published by MC, jduck, including Metasploit module auxiliary/scanner/http/tomcat_mgr_login.

AI-analyzed exploit summary This Metasploit module attempts to brute-force login credentials for the Tomcat Application Manager by testing default or provided usernames and passwords. It checks for HTTP 401 responses and validates successful logins.

Description

HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.

Exploits (4)

metasploit SCANNER
by MC · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb

This Metasploit module attempts to brute-force login credentials for the Tomcat Application Manager by testing default or provided usernames and passwords. It checks for HTTP 401 responses and validates successful logins.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Apache Tomcat (multiple versions)
Auth required
Prerequisites: Access to Tomcat Manager interface · Valid or default credentials
devstral-2 · analyzed Jun 05, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb

This Metasploit module exploits Apache Tomcat's Manager application to upload and execute a malicious WAR file, leveraging authenticated access to achieve remote code execution. It handles CSRF tokens, session management, and payload deployment/cleanup.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Tomcat (with exposed Manager application)
Auth required
Prerequisites: Valid credentials for Tomcat Manager · Exposed /manager/html/upload endpoint
devstral-2 · analyzed Apr 24, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by jduck · rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb

This Metasploit module exploits Apache Tomcat's Manager application to deploy a malicious WAR archive containing a JSP payload, achieving authenticated remote code execution. It supports multiple platforms (Java, Windows, Linux) and includes functionality for automatic target detection and cleanup.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Tomcat (with exposed Manager application)
Auth required
Prerequisites: Valid credentials for Tomcat Manager · Exposed Tomcat Manager application
devstral-2 · analyzed Apr 24, 2026 Full analysis →
exploitdb WORKING POC
rubyremotemultiple
https://www.exploit-db.com/exploits/16317

This Metasploit module exploits Apache Tomcat's Manager application to deploy a malicious WAR archive containing a JSP payload, achieving remote code execution. It supports multiple platforms and architectures, and includes automatic target detection.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Tomcat (versions with exposed Manager application)
Auth required
Prerequisites: Valid credentials for Tomcat Manager · Exposed Tomcat Manager application
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1023222
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=125873415424980&w=2
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-09-085/
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/54361
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37444
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/60317

Scores

EPSS 0.8683
EPSS Percentile 99.4%

Details

CWE
CWE-264
Status published
Products (1)
hp/operations_manager 8.10
Published Nov 24, 2009
Tracked Since Feb 18, 2026