Apache Tomcat JK Connector Vulnerability in libapache-mod-jk: Path Normalization Flaw
Summary
CVE-2018-11759: The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. Affects libapache-mod-jk versions < 1:1.2.46-1. Fixed in 1:1.2.46-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libapache-mod-jk is a connector module for the Apache Web Server that allows it to communicate with Apache Tomcat. This module is essential for integrating web applications running on Tomcat with the Apache HTTP Server, enabling features like load balancing and reverse proxying. However, it has been found to have a vulnerability that affects how it normalizes requested paths, potentially exposing unintended application functionality.
Vulnerability Detail
The vulnerability, identified as CVE-2018-11759, arises from improper handling of path normalization in the Apache Tomcat JK Connector versions 1.2.0 to 1.2.44. This flaw allows specially crafted requests to bypass access controls and expose application functionalities that should not be accessible through the reverse proxy. The issue is particularly concerning when only a subset of URLs is exposed, as it can lead to unauthorized access to sensitive application features.
How To Fix
Minimum fixed version
1:1.2.46-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libapache-mod-jkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected URLs in the Apache configuration to mitigate the risk of unauthorized access until the package is updated. This can be done by adding specific access control rules in the httpd.conf file, such as: <Location /sensitive-path> Require all denied </Location>
Conclusion
CVE-2018-11759 represents a significant security vulnerability in the libapache-mod-jk package, which can lead to unauthorized access to application functionalities. It is crucial for users to upgrade to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for libapache-mod-jk →
FAQ
CVE-2018-11759 is a vulnerability in the Apache Tomcat JK Connector that allows unauthorized access to application functionalities through improper path normalization.
The affected versions are libapache-mod-jk versions 1.2.0 to 1.2.44.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2018-11759 is 7.5, indicating a high severity level.
If immediate upgrading is not possible, implement access control measures in your Apache configuration to restrict access to sensitive paths as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-mod-jk.
