Session Fixation Vulnerability in Apache Tomcat 9, 8, and 7
Summary
CVE-2019-17563: When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. Affects tomcat9 across 4 version ranges.
< 9.0.31-1
>= 16bf392c67833ad549733b58c350ff92b5ee782a, <= d628ee1e6e1121d60b4990239c242d0e18a25e42
>= e37b977db6f47e4380ad67114a49e8568951c953, <= e0c759f3bd47e06b9d526ed40ed9d1e923f464b6
>= e498667bd7811e846771a852b16ce9f1e524b81b, <= fde40d7e0c7a1b0b2423cb84ad220a5d98b65591
Fixed in 9.0.31-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications. The affected versions, ranging from 7.0.0 to 9.0.29, have a vulnerability that could allow attackers to exploit session fixation attacks, which can compromise user sessions.
Vulnerability Detail
The vulnerability arises from a narrow window during FORM authentication in Apache Tomcat versions 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49, and 7.0.0 to 7.0.98. During this window, an attacker could potentially fixate a user's session, allowing unauthorized access to the user's account. Although the exploit was deemed impractical due to the narrowness of the window, it was still classified as a security vulnerability due to the potential risks involved.
How To Fix
Minimum fixed version
9.0.31-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tomcat9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing additional security measures such as enforcing secure session management practices, including using HTTPS and setting appropriate session timeout values. However, these measures do not fully mitigate the vulnerability and should only be temporary solutions.
Conclusion
The session fixation vulnerability in Apache Tomcat poses a significant risk to applications using affected versions. It is crucial for users to upgrade to the latest version to mitigate this risk effectively. Employing additional security practices can also help in managing potential threats until an upgrade can be performed.
See every vulnerability recorded for tomcat9 →
FAQ
Session fixation is a type of attack where an attacker tricks a user into using a specific session ID, allowing the attacker to hijack the user's session.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The affected versions include Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49, and 7.0.0 to 7.0.98.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If immediate upgrading is not possible, implement additional security measures such as secure session management and monitor your application closely for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat9.
