CVE-2016-5388: Improper Access Control in Apache Tomcat
Summary
CVE-2016-5388: Improper Access Control in Apache Tomcat. Affects org.apache.tomcat:tomcat-catalina across 2 version ranges.
>= 7.0.0, < 7.0.72
>= 8.0.0, < 8.5.5
Fixed in 7.0.72 or 8.5.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The Apache Tomcat package includes various components, including the Tomcat Catalina module, which is responsible for processing HTTP requests and managing the servlet container. This vulnerability affects Apache Tomcat versions 7.x through 7.0.70 and 8.x through 8.5.4 when the CGI Servlet is enabled.
Vulnerability Detail
The vulnerability, known as "httpoxy", is an improper access control issue in Apache Tomcat. It arises from the fact that Tomcat follows RFC 3875 section 4.1.18, which does not protect applications from untrusted client data in the HTTP_PROXY environment variable. This allows remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server by crafting a Proxy header in an HTTP request. The impact of this vulnerability is that an attacker can control the outbound HTTP traffic of an affected application, potentially leading to unauthorized access or data leakage.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.727.0.72 -
>= 8.0.0, < 8.5.58.5.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a workaround can be implemented by disabling the CGI Servlet in Apache Tomcat. This can be done by removing or commenting out the relevant configuration in the Tomcat server's web.xml file. By disabling the CGI Servlet, the vulnerability is mitigated as the Proxy header will no longer be processed. However, it is recommended to apply the official patches or upgrade to a fixed version as soon as possible.
Conclusion
The "httpoxy" vulnerability in Apache Tomcat can be mitigated by upgrading to a fixed version or applying the provided patches. If immediate upgrade is not possible, disabling the CGI Servlet can serve as a temporary workaround. It is important to take prompt action to ensure the security of the affected Apache Tomcat installations. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat-catalina →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications.
This vulnerability affects Apache Tomcat versions 7.x through 7.0.70 and 8.x through 8.5.4 when the CGI Servlet is enabled.
The impact of this vulnerability is that an attacker can control the outbound HTTP traffic of an affected application, potentially leading to unauthorized access or data leakage.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache Tomcat. For Apache Tomcat 7.x, upgrade to version 7.0.72 or later. For Apache Tomcat 8.x, upgrade to version 8.5.5 or later.
Yes, a workaround is available by disabling the CGI Servlet in Apache Tomcat. This can be done by removing or commenting out the relevant configuration in the Tomcat server's web.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat-catalina.
