CVE-2012-3546: Authentication Bypass in Apache Tomcat
Summary
CVE-2012-3546: Authentication Bypass in Apache Tomcat. Affects org.apache.tomcat:tomcat across 2 version ranges.
>= 6.0.0, < 6.0.36
>= 7.0.0, < 7.0.30
Fixed in 6.0.36 or 7.0.30, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The vulnerability identified as CVE-2012-3546 affects Apache Tomcat versions 6.x before 6.0.36 and 7.x before 7.0.30. This vulnerability specifically impacts the FORM authentication mechanism in Apache Tomcat.
Vulnerability Detail
The vulnerability allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI. This means that an attacker can bypass the authentication process and gain unauthorized access to protected resources. The vulnerability has a moderate severity rating and is classified under CWE-287 (Improper Authentication). It was first published on May 17, 2022, and the latest modification was made on July 13, 2022.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.366.0.36 -
>= 7.0.0, < 7.0.307.0.30
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a workaround by modifying the security-constraint configuration in the web.xml file of their Apache Tomcat installation. By explicitly specifying the required authentication method and denying access to the /j_security_check URI, the vulnerability can be mitigated. Here is an example of the modified web.xml configuration:
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected Resources</web-resource-name>
<url-pattern>/protected/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>authorizedRole</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Workaround for Authentication Bypass</web-resource-name>
<url-pattern>/j_security_check</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
This workaround ensures that the /j_security_check URI is protected and requires authentication, preventing the bypass vulnerability.
Conclusion
The authentication bypass vulnerability in Apache Tomcat poses a risk to the security of web applications hosted on affected versions. It is crucial for users to upgrade to the recommended patched versions or implement the provided workaround to mitigate the vulnerability. Regular monitoring and vulnerability scanning using tools like Vulert can help ensure the ongoing security of Apache Tomcat installations. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
The vulnerability allows attackers to bypass authentication and gain unauthorized access to protected resources. This can lead to unauthorized data disclosure, modification, or deletion, depending on the permissions associated with the compromised user account.
Users of Apache Tomcat versions 6.x before 6.0.36 and 7.x before 7.0.30 are affected by this vulnerability. Organizations and individuals using these versions of Apache Tomcat for hosting Java web applications should take immediate action to address the vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the necessary patches and security updates to mitigate the risk of potential exploitation.
Yes, this vulnerability can be exploited remotely. Attackers can leverage the authentication bypass technique over the network to gain unauthorized access to protected resources hosted on the vulnerable Apache Tomcat server.
You can use Vulert, a vulnerability monitoring tool, to check if your Apache Tomcat installation is affected by this vulnerability. Vulert analyzes the pom.xml file of your project and provides real-time alerts for open-source vulnerabilities. You can access the Vulert playground at Vulert Scanner to check the vulnerability status without any signup or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
