← back to portfolio
Web Security
Apache Tomcat Serialized Payload RCE
Executive Summary
An alert for SOC334 – Apache Tomcat RCE Exploitation (CVE-2024-50379) flagged suspicious web activity
on host TOM-UPLOAD01. Investigation confirmed a malicious JSP file was uploaded and used as a web shell,
exploiting a TOCTOU race condition in Tomcat's JSP compilation on a case-insensitive file system.
The attacker used the shell to run reconnaissance commands, but no evidence of persistence,
privilege escalation, or destructive impact was found in the available logs.
Scenario
The alert was triggered by the SOC334 rule for Apache Tomcat RCE Exploitation Detected (CVE-2024-50379).
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability during JSP compilation in Apache Tomcat
permits remote code execution on case-insensitive file systems when the default servlet is enabled for
write access (non-default configuration). The alert identified a suspicious web attack against server
TOM-UPLOAD01 (172.16.20.47).
Evidence Collected
| Artifact | Type | Why It Mattered |
|---|
| 3.144.85.113 | IPv4 Address | External source IP responsible for uploading and interacting with the JSP web shell |
| FILE.jsp | JSP File | Malicious JSP uploaded to the server and used as a web shell |
| /xampp/tomcat/webapps/ROOT/uploads/file.jsp | File Path | Confirmed the location of the uploaded web shell |
| tasklist.exe | Process Creation | Confirmed commands issued through the web shell executed on the host |
Timeline
| Time (UTC) | Source IP | Event | Source |
|---|
| 10 Jan 13:53–13:54 | 3.144.85.113 | Uploaded FILE.jsp via POST /upload.jsp | Web Server Logs |
| 10 Jan 13:53:49 | 3.144.85.113 | Executed whoami through the uploaded web shell | Web Server Logs |
| 10 Jan 13:54:01 | 3.144.85.113 | Executed net user through the uploaded web shell | Web Server Logs |
| 10 Jan 13:54:11 | 3.144.85.113 | Executed whoami /priv through the uploaded web shell | Web Server Logs |
| 10 Jan 13:54:23 | 3.144.85.113 | Executed tasklist through the uploaded web shell | Web Server Logs |
Key Findings
- The uploaded JSP file functioned as a web shell, allowing the attacker to execute arbitrary OS commands on the compromised server.
- The attacker performed host, user, and privilege enumeration following successful code execution.
- Endpoint process evidence corroborates that commands issued through the web shell resulted in execution on the Windows host.
- No destructive or data-impacting activity was observed in the available evidence.
Attack Chain
Exploitation
Attacker sent a POST request to /upload.jsp to upload FILE.jsp.
Execution
cmd= parameters observed being passed to /uploads/file.jsp shortly after upload.
Discovery
Reconnaissance commands executed on the endpoint: whoami, net user, whoami /priv, tasklist.
Impact
No destructive or data-impacting activity was observed in the available evidence.
Analyst Notes
Began by validating the alert details and identifying the affected host and external source IP.
Reviewed web server logs to determine whether exploitation had occurred.
Identified an uploaded JSP file followed by repeated requests containing cmd= parameters, indicating possible web shell activity.
Correlated the observed HTTP requests with host process evidence to confirm OS command execution.
Observed reconnaissance commands but found no evidence of persistence or privilege escalation in the available logs.
A second external IP generated only HTTP 404 responses and could not be correlated with successful exploitation.