Description
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
CVSS breakdown
CVSS 3.0
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected products
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat7.0.23 – 7.0.90
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- Apache Software Foundation / Apache Tomcat7.0.23 to 7.0.90 – 7.0.23 to 7.0.90
- Apache Software Foundation / Apache Tomcat8.5.0 to 8.5.33 – 8.5.0 to 8.5.33
- Apache Software Foundation / Apache Tomcat9.0.0.M1 to 9.0.11 – 9.0.0.M1 to 9.0.11
- Canonical / Ubuntu Linux16.04 – 16.04
- Canonical / Ubuntu Linux14.04 – 14.04
- Debian / debian_linux8.0 – 8.0
- NetApp / snap_creator_framework
- oracle / communications_application_session_controller3.7.1 – 3.7.1
- oracle / communications_application_session_controller3.8.0 – 3.8.0
- oracle / hospitality_guest_access4.2.1 – 4.2.1
- oracle / hospitality_guest_access4.2.0 – 4.2.0
- oracle / instantis_enterprisetrack17.3 – 17.3
- oracle / instantis_enterprisetrack17.2 – 17.2
- oracle / instantis_enterprisetrack17.1 – 17.1
- oracle / retail_order_broker15.0 – 15.0
- oracle / retail_order_broker5.1 – 5.1
- oracle / retail_order_broker5.2 – 5.2
- oracle / secure_global_desktop5.4 – 5.4
- RedHat / enterprise_linux_desktop7.0 – 7.0
- RedHat / enterprise_linux_server7.6 – 7.6
- RedHat / enterprise_linux_server7.0 – 7.0
- RedHat / enterprise_linux_server_aus7.6 – 7.6
- RedHat / enterprise_linux_server_eus7.6 – 7.6
- RedHat / enterprise_linux_server_tus7.6 – 7.6
- RedHat / enterprise_linux_workstation7.0 – 7.0
Exploits & proofs of concept
- exploit-dbApache Tomcat 9.0.0.M1 - Open Redirectby Central InfoSec
- nucleiApache Tomcat - Open Redirectby geeknik
References
- VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- MAILING_LISThttps://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E
- MISChttps://security.netapp.com/advisory/ntap-20181014-0002/
- MISChttp://www.securityfocus.com/bid/105524
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:0131
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:0485
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:0130
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2018/10/msg00005.html
- VENDOR_ADVISORYhttps://usn.ubuntu.com/3787-1/
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2018/10/msg00006.html
- MAILING_LISThttps://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/
- MAILING_LISThttps://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
- VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:1529
- MISChttps://kc.mcafee.com/corporate/index?page=content&id=SB10284
- VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
- VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- VENDOR_ADVISORYhttps://www.debian.org/security/2019/dsa-4596
- MAILING_LISThttps://seclists.org/bugtraq/2019/Dec/43
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2020.html
- MAILING_LISThttps://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2020.html
- EXPLOIThttp://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html
Updated 10m ago · 8 sources