Apache Tomcat - Open Redirect

mediumseverity

4.3CVSS score

97.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.

Impact

An attacker can redirect users to malicious websites, leading to phishing attacks or the download of malware.

Fix

Upgrade to Apache Tomcat version 9.0.12 or later, or apply the relevant patch provided by the Apache Software Foundation.

How to confirm it

Send: GET {{BaseURL}}//interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*…/ AND not status 404

Run it with nuclei: nuclei -id CVE-2018-11784 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-11784

info:
  name: Apache Tomcat - Open Redirect
  author: geeknik
  severity: medium
  description: |
    Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.
  impact: |
    An attacker can redirect users to malicious websites, leading to phishing attacks or the download of malware.
  remediation: |
    Upgrade to Apache Tomcat version 9.0.12 or later, or apply the relevant patch provided by the Apache Software Foundation.
  reference:
    - https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75@%3Cannounce.tomcat.apache.org%3E
    - https://nvd.nist.gov/vuln/detail/CVE-2018-11784
    - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html
    - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
    - http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2018-11784
    cwe-id: CWE-601
    epss-score: 0.9768
    epss-percentile: 0.99904
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: tomcat
    shodan-query:
      - title:"Apache Tomcat"
      - http.title:"apache tomcat"
      - http.html:"apache tomcat"
      - cpe:"cpe:2.3:a:apache:tomcat"
    fofa-query:
      - body="apache tomcat"
      - title="apache tomcat"
    google-query: intitle:"apache tomcat"
  tags: cve,cve2018,packetstorm,tomcat,redirect,apache,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}//interact.sh"

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*\.)?interact\.sh\/?(\/.*)?$'

      - type: status
        negative: true
        status:
          - 404

References

Use this check only on systems you are authorised to test. Where the data comes from