Access Control: Jolokia \<= 1.7.1 Information Leakage¶

Identifier: jolokia_tomcat_creds_leak

Scanner(s) Support¶

Description¶

Tomcat's credential disclosure leading to Remote Code Execution via WAR upload.

Reference:

• https://github.com/laluka/jolokia-exploitation-toolkit/blob/main/exploits/info-leak-tomcat-creds.py
• https://therealcoiffeur.github.io/c11011

Configuration¶

Example¶

Example configuration:

---
security_tests:
  jolokia_tomcat_creds_leak:
    assets_allowed:
    - REST
    - GRAPHQL
    - WEBAPP
    skip: false

Reference¶

assets_allowed¶

Type : List[AssetType]*

List of assets that this check will cover.

skip¶

Type : boolean

Skip the test if true.