CVE-2009-3843
HP Operations Manager 8.10 - Unauthenticated Remote Code Execution via Tomcat Manager Upload
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2009-3843.
PoCs published by MC, jduck, including Metasploit module auxiliary/scanner/http/tomcat_mgr_login.
AI-analyzed exploit summary This Metasploit module attempts to brute-force login credentials for the Tomcat Application Manager by testing default or provided usernames and passwords. It checks for HTTP 401 responses and validates successful logins.
Description
HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.
Exploits (4)
This Metasploit module attempts to brute-force login credentials for the Tomcat Application Manager by testing default or provided usernames and passwords. It checks for HTTP 401 responses and validates successful logins.
This Metasploit module exploits Apache Tomcat's Manager application to upload and execute a malicious WAR file, leveraging authenticated access to achieve remote code execution. It handles CSRF tokens, session management, and payload deployment/cleanup.
This Metasploit module exploits Apache Tomcat's Manager application to deploy a malicious WAR archive containing a JSP payload, achieving authenticated remote code execution. It supports multiple platforms (Java, Windows, Linux) and includes functionality for automatic target detection and cleanup.
This Metasploit module exploits Apache Tomcat's Manager application to deploy a malicious WAR archive containing a JSP payload, achieving remote code execution. It supports multiple platforms and architectures, and includes automatic target detection.