lib/tasks/vulns/tomcat_persistent_manager_cve_2020_9484.rb
## Default method, subclasses must override this
Default method, subclasses must override this
Default method subclasses must override this
def run
      super
      uri = "#{_get_entity_name}/index.jsp"
      attacker_controlled_path = _get_option("attacker_controlled_path")
      test_jsession_header = { "cookie" => "JSESSIONID=#{attacker_controlled_path}" } 
      response = http_get_body uri, nil, test_jsession_header
      if response =~ /org.apache.catalina.session.FileStore/
        _create_linked_issue "tomcat_persistent_manager_cve_2020_9484"
      else 
        _log "Not vulnerable or unable to detect a file on disk"
      end
    end
def run super uri = "#{_get_entity_name}/index.jsp" attacker_controlled_path = _get_option ( "attacker_controlled_path" ) test_jsession_header = { "cookie" => "JSESSIONID=#{attacker_controlled_path}" } response = http_get_body uri , nil , test_jsession_header if response =~ / org.apache.catalina.session.FileStore / _create_linked_issue "tomcat_persistent_manager_cve_2020_9484" else _log "Not vulnerable or unable to detect a file on disk" end end
Default method, subclasses must override this
Default method subclasses must override this
# vulnerable # not vulnerable  