CVE-2018-8014: Insecure CORS Filter Settings in Apache Tomcat
Summary
CVE-2018-8014: The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. Affects org.apache.tomcat.embed:tomcat-embed-core across 4 version ranges.
>= 7.0.41, < 7.0.88
>= 8.0.0RC1, < 8.0.53
>= 8.5.0, < 8.5.32
>= 9.0.0.M1, < 9.0.9
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The CORS (Cross-Origin Resource Sharing) filter is a component in Apache Tomcat that allows web applications to make cross-origin requests. By default, the CORS filter in Apache Tomcat has insecure settings that enable 'supportsCredentials' for all origins.
Vulnerability Detail
The insecure default settings of the CORS filter in Apache Tomcat versions 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.41 to 7.0.88 allow for the 'supportsCredentials' option to be enabled for all origins. This means that any website can make requests to the affected Apache Tomcat server and include user credentials, such as cookies, in those requests. This can lead to unauthorized access to sensitive information or perform actions on behalf of the user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.41, < 7.0.887.0.88 -
>= 8.0.0RC1, < 8.0.538.0.53 -
>= 8.5.0, < 8.5.328.5.32 -
>= 9.0.0.M1, < 9.0.99.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A possible workaround for this vulnerability is to disable the CORS filter entirely if it is not required for your application. This can be done by removing or commenting out the CORS filter configuration in the 'web.xml' file. However, this may impact the functionality of your application if it relies on cross-origin requests.
Conclusion
The insecure default settings of the CORS filter in Apache Tomcat can lead to unauthorized access to sensitive information or perform actions on behalf of the user. It is important to review and update the CORS filter configuration to only allow 'supportsCredentials' for trusted origins. For further assistance and support in fixing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
This vulnerability allows any website to make requests to the affected Apache Tomcat server and include user credentials, such as cookies, in those requests. This can lead to unauthorized access to sensitive information or perform actions on behalf of the user.
The affected versions include Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.41 to 7.0.88.
To fix this vulnerability, you need to review and update the CORS filter configuration in your Apache Tomcat installation. Specifically, you should only enable 'supportsCredentials' for trusted origins that require it.
Yes, you can disable the CORS filter entirely if it is not required for your application. However, this may impact the functionality of your application if it relies on cross-origin requests.
Yes, the CVSS score for this vulnerability is 9.8, which indicates a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
