CVE-2015-5345: Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

Background

Apache Tomcat is an open-source web server and servlet container that is used to deploy and run Java web applications. It provides a Java HTTP web server environment for running Java code. The vulnerability identified as CVE-2015-5345 affects versions 6.x, 7.x, 8.x, and 9.x of Apache Tomcat. This vulnerability allows remote attackers to determine the existence of a directory by exploiting a flaw in the Mapper component. The Mapper component processes redirects before considering security constraints and Filters, which can be exploited by attackers to identify the existence of a directory via a URL that lacks a trailing slash character.

Vulnerability Detail

The vulnerability arises from the improper limitation of a pathname to a restricted directory in Apache Tomcat. By exploiting this vulnerability, remote attackers can determine the existence of a directory by sending a specially crafted URL that lacks a trailing slash character. This can lead to information disclosure and potentially aid attackers in further exploiting the system. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.

Workaround

As a workaround, users can manually add a trailing slash character to the URLs to prevent the disclosure of directory existence. This can be done by modifying the URLs in the application code or web server configuration. Here is an example of how to add a trailing slash to a URL in Java:

String url = "http://example.com/directory";
if (!url.endsWith("/")) {
    url += "/";
}

By ensuring that all URLs have a trailing slash, the vulnerability can be mitigated.

Conclusion

The vulnerability identified as CVE-2015-5345 in Apache Tomcat can be exploited by remote attackers to determine the existence of a directory. It is recommended to upgrade to the fixed versions of Apache Tomcat to mitigate this vulnerability. A workaround is available by manually adding a trailing slash to URLs. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.tomcat:tomcat →

FAQ