CVE-2017-7675: Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Summary
CVE-2017-7675: Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat. Affects org.apache.tomcat:tomcat across 2 version ranges.
>= 8.5.0, < 8.5.16
>= 9.0.0.M1, < 9.0.0.M22
Fixed in 8.5.16 or 9.0.0.M22, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a robust and scalable platform for hosting web applications and is widely used in production environments. However, a vulnerability has been discovered in versions 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 of Apache Tomcat that allows for directory traversal attacks. This vulnerability can be exploited by an attacker to bypass security constraints and access restricted directories on the server.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7675, is due to the HTTP/2 implementation in Apache Tomcat bypassing several security checks that are designed to prevent directory traversal attacks. By crafting a specially crafted URL, an attacker can bypass security constraints and access directories that should be restricted. This can lead to unauthorized access to sensitive files and data on the server. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.168.5.16 -
>= 9.0.0.M1, < 9.0.0.M229.0.0.M22
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a workaround can be implemented by disabling the HTTP/2 protocol in Apache Tomcat. This can be done by modifying the server configuration to remove the HTTP/2 connector or by disabling the HTTP/2 protocol in the connector configuration. Here is an example of how to disable the HTTP/2 protocol in the server configuration:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS"/>
By removing the protocol="org.apache.coyote.http2.Http2Protocol" attribute from the connector configuration, the HTTP/2 protocol will be disabled.
Conclusion
In conclusion, CVE-2017-7675 is a high-severity vulnerability in Apache Tomcat that allows for directory traversal attacks. It is important to upgrade to a fixed version of Apache Tomcat or apply the workaround to mitigate the risk of unauthorized access to sensitive files and data. Regularly updating Apache Tomcat and monitoring for vulnerabilities using tools like Vulert can help ensure the security of your web applications.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a robust and scalable platform for hosting web applications.
Directory traversal is a technique used by attackers to access files and directories that are outside of the intended scope. It involves manipulating file paths to navigate to parent directories or other restricted locations.
This vulnerability allows an attacker to bypass security constraints and access restricted directories on the server. This can lead to unauthorized access to sensitive files and data, potentially exposing confidential information or allowing for further attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Apache Tomcat installation is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for any open-source vulnerabilities, including CVE-2017-7675.
Yes, this vulnerability has a CVSS score of 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.