CVE-2016-5425

HIGH

Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation

Title source: metasploit

Exploitation Summary

EIP tracks 2 public exploits for CVE-2016-5425. PoCs published by Dawid Golunski, h00die, Dawid Golunski <[email protected]>, including Metasploit module exploits/linux/local/tomcat_rhel_based_temp_priv_esc.

AI-analyzed exploit summary This exploit leverages insecure permissions on the tomcat.conf file in RedHat-based distributions to inject malicious configurations, creating a root shell and reverse shell via systemd-tmpfiles execution.

Description

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

Exploits (2)

exploitdb WORKING POC

by Dawid Golunski · textlocallinux

https://www.exploit-db.com/exploits/40488

View Code ZIP pw:eip

This exploit leverages insecure permissions on the tomcat.conf file in RedHat-based distributions to inject malicious configurations, creating a root shell and reverse shell via systemd-tmpfiles execution.

Classification

Working Poc 100%

Attack Type

Lpe

Complexity

Trivial

Reliability

Reliable

Target: Apache Tomcat (RedHat-based distros packaging)

No auth needed

Prerequisites: Write access to /usr/lib/tmpfiles.d/tomcat.conf as tomcat user · systemd-tmpfiles execution (e.g., on reboot or via service)

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC MANUAL

by h00die, Dawid Golunski <[email protected]> · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/tomcat_rhel_based_temp_priv_esc.rb

View Code ZIP pw:eip

This Metasploit module exploits CVE-2016-5425, a privilege escalation vulnerability in Apache Tomcat on RedHat-based systems due to improper file permissions on /usr/lib/tmpfiles.d/tomcat.conf. It injects a cron job via systemd-tmpfiles to execute a payload with root privileges.