I am trying to exploit a vulnerability in tomcat based on CVE-2020-13935.
I found online this interesting poc https://blog.redteam-pentesting.de/2020/websocket-vulnerability-tomcat/ In my case, the tomcat server is exposed through a reverse proxy (apached httpd), and I am not sure how can I run the exploit. Should I run the poc on the exposed port by the httpd? or in this case I cannot do the exploit?
This specific vulnerability works by exploiting invalid payload length in Websocket frames. Websocket frames are exchanged after the initial Websocket upgrade.
A simple reverse proxy will simply pass through any data in both directions after the initial Websocket upgrade, since no further analysis is needed to fullfil its function as reverse proxy. In this case the vulnerability would not be mitigated by the reverse proxy.
A more security focused reverse proxy will understand the Websocket frame protocol and ensure that proper Websocket is spoken. In this case the vulnerability can be mitigated by the reverse proxy since it will detect improper Websocket frames and close the connection due to protocol error.
Given that Apache has no websocket specific configuration I would assume that it is only a simple proxy, i.e. that it will simply pass through all traffic after the initial Websocket upgrade. In this case this specific vulnerability would not be mitigated. But this is only an assumption, one probably need to look into the code of Apache to be sure.
