CVE-2015-5174: Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Summary
CVE-2015-5174: Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 6.0.0, < 6.0.45
>= 7.0.0, < 7.0.65
>= 8.0.0-RC1, < 8.0.27
Fixed in 6.0.45, 7.0.65 or 8.0.27, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. Apache Tomcat is widely used in various industries and is known for its performance and scalability. However, a vulnerability has been discovered in versions 6.x, 7.x, and 8.x of Apache Tomcat that allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory. This vulnerability can be exploited by using a directory traversal technique in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call. The vulnerability has been assigned the CVE identifier CVE-2015-5174.
Vulnerability Detail
The vulnerability in Apache Tomcat allows remote authenticated users to bypass SecurityManager restrictions and list a parent directory by using a directory traversal technique. This can be achieved by including a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive files and directories on the server. The impact of this vulnerability can vary depending on the specific configuration and files accessible to the web application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.456.0.45 -
>= 7.0.0, < 7.0.657.0.65 -
>= 8.0.0-RC1, < 8.0.278.0.27
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version of Apache Tomcat is not immediately possible, a temporary workaround can be implemented. One possible workaround is to restrict access to the vulnerable web application by configuring access controls or firewall rules. Additionally, it is recommended to review the web application's code and ensure that proper input validation and sanitization techniques are implemented to prevent directory traversal attacks.
Conclusion
The vulnerability in Apache Tomcat (CVE-2015-5174) allows remote authenticated users to bypass SecurityManager restrictions and list a parent directory. Upgrading to a fixed version of Apache Tomcat is the recommended solution to mitigate the risk of exploitation. Implementing proper input validation and sanitization techniques in the web application's code can also help prevent directory traversal attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications.
Directory traversal, also known as path traversal, is a technique used by attackers to access files and directories that are located outside the intended directory. It involves manipulating file paths to navigate to parent directories and access sensitive files.
This vulnerability can be exploited by remote authenticated users who have access to a web application running on an affected version of Apache Tomcat. By including a directory traversal sequence in a pathname used by the web application, an attacker can bypass SecurityManager restrictions and list a parent directory, potentially gaining unauthorized access to sensitive files.
The impact of this vulnerability can vary depending on the specific configuration and files accessible to the web application. In some cases, it may allow an attacker to access sensitive files and directories on the server, potentially leading to further compromise or unauthorized disclosure of information.
To mitigate the risk of exploitation, it is recommended to upgrade to a fixed version of Apache Tomcat as soon as possible. Additionally, implementing proper input validation and sanitization techniques in the web application's code can help prevent directory traversal attacks.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
