Testing VULNERABLE version (11.0.20)
Apr 14, 2026 12:52:57 PM org.apache.catalina.tribes.group.interceptors.EncryptInterceptor createEncryptionManager
WARNING: The EncryptInterceptor is using the algorithm [AES/CBC/PKCS5Padding]. It is recommended to switch to using AES/GCM/NoPadding.
Apr 14, 2026 12:52:57 PM org.apache.catalina.tribes.group.interceptors.EncryptInterceptor messageReceived
SEVERE: Failed to decrypt message
javax.crypto.IllegalBlockSizeException: Input length must be multiple of 16 when decrypting with padded cipher
	at java.base/com.sun.crypto.provider.CipherCore.prepareInputBuffer(CipherCore.java:890)
	at java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:729)
	at java.base/com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:446)
	at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2303)
	at org.apache.catalina.tribes.group.interceptors.EncryptInterceptor$BaseEncryptionManager.decrypt(EncryptInterceptor.java:553)
	at org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.messageReceived(EncryptInterceptor.java:135)
	at TestVuln.main(TestVuln.java:38)

BYPASS CONFIRMED: Malformed ciphertext was forwarded downstream