# threedr3am/tomcat-cluster-session-sync-exp

<https://repo.masters-masters.com/en/repos/threedr3am/tomcat-cluster-session-sync-exp>

[Home](https://repo.masters-masters.com/en) › [threedr3am](https://repo.masters-masters.com/en/owners/threedr3am) › [tomcat-cluster-session-sync-exp](https://repo.masters-masters.com/en/repos/threedr3am/tomcat-cluster-session-sync-exp)

threedr3am/tomcat-cluster-session-sync-exp has 214 stars on GitHub. Its RepoMasters card: Prototype tier. tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor…

| Field | Value |
| --- | --- |
| Owner | [threedr3am](https://repo.masters-masters.com/en/owners/threedr3am) |
| Stars | 214 |
| Forks | 37 |
| Language | [Java](https://repo.masters-masters.com/en/languages/java) |
| License | None |
| Created | 2020 |
| Tier | [Prototype (100 to 249 ★)](https://repo.masters-masters.com/en/ranks/rush) |
| View on GitHub | [threedr3am/tomcat-cluster-session-sync-exp](https://github.com/threedr3am/tomcat-cluster-session-sync-exp) |

## Repository

tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包， 可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484是session持久化的洞，这个是session集群同步的洞！

The tier for repos with 100 to 249 ★. Published odds per card pulled: 70%. Rarity: Common.

## More repos by threedr3am

- [threedr3am/learnjavabug · ★ 2,682 · Java · RC](https://repo.masters-masters.com/en/repos/threedr3am/learnjavabug)
- [threedr3am/JSP-WebShells · ★ 1,394 · Java · Beta](https://repo.masters-masters.com/en/repos/threedr3am/JSP-WebShells)
- [threedr3am/ZhouYu · ★ 615 · Java · Alpha](https://repo.masters-masters.com/en/repos/threedr3am/ZhouYu)
- [threedr3am/dubbo-exp · ★ 162 · Java · Prototype](https://repo.masters-masters.com/en/repos/threedr3am/dubbo-exp)
- [threedr3am/log-agent · ★ 123 · Java · Prototype](https://repo.masters-masters.com/en/repos/threedr3am/log-agent)

## Nearby in Java

- [ayunami2000/ayunpictojava · ★ 214 · Java · Prototype](https://repo.masters-masters.com/en/repos/ayunami2000/ayunpictojava)
- [safa-yesilyurt/spring-boot-microservices · ★ 214 · Java · Prototype](https://repo.masters-masters.com/en/repos/safa-yesilyurt/spring-boot-microservices)
- [chsami/Microbot · ★ 214 · Java · Prototype](https://repo.masters-masters.com/en/repos/chsami/Microbot)
- [ajsutton/disruptorWizard · ★ 214 · Java · Prototype](https://repo.masters-masters.com/en/repos/ajsutton/disruptorWizard)
- [Ninja-Squad/DbSetup · ★ 214 · Java · Prototype](https://repo.masters-masters.com/en/repos/Ninja-Squad/DbSetup)
- [koreader/kpvbooklet · ★ 214 · Java · Prototype](https://repo.masters-masters.com/en/repos/koreader/kpvbooklet)

---
Data: GitHub · Illustration drawn by RepoMasters from the repo’s ID and its language color.