Apache Tomcat - HTTP Request Smuggling

mediumseverity

5.3CVSS score

5.9%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Apache Tomcat from versions 8.5.0 to 8.5.93, 9.0.0-M1 to 9.0.81, 10.1.0-M1 to 10.1.13, and 11.0.0-M1 to 11.0.0-M11 contain an improper input validation caused by incorrect parsing of HTTP trailer headers, letting attackers craft headers to cause request smuggling, exploit requires sending malicious trailer headers.

Impact

Attackers can perform request smuggling, potentially leading to cache poisoning, session hijacking, or bypassing security controls.

Fix

Upgrade to version 11.0.0-M12, 10.1.14, 9.0.81, or 8.5.94 or later.

How to confirm it

Send: GET {{BaseURL}}/{{randstr}}
Positive when: status_code == 404 and contains(body, "Apache Tomcat/") and regex("Apache Tomcat/(8\.5\.(0|[1-9]|[1-8][0-9]|9[0-3])|9\.0\.(0(-M\d+)?|[1-9]|[1-7][0-9]|80)|10\.1\.(0(-M\d+)?|[1-9]|1[0-3])|11\.0\.0-M([1…

Run it with nuclei: nuclei -id CVE-2023-45648 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-45648

info:
  name: Apache Tomcat - HTTP Request Smuggling
  author: 0x_Akoko
  severity: medium
  description: |
    Apache Tomcat from versions 8.5.0 to 8.5.93, 9.0.0-M1 to 9.0.81, 10.1.0-M1 to 10.1.13, and 11.0.0-M1 to 11.0.0-M11 contain an improper input validation caused by incorrect parsing of HTTP trailer headers, letting attackers craft headers to cause request smuggling, exploit requires sending malicious trailer headers.
  impact: |
    Attackers can perform request smuggling, potentially leading to cache poisoning, session hijacking, or bypassing security controls.
  remediation: |
    Upgrade to version 11.0.0-M12, 10.1.14, 9.0.81, or 8.5.94 or later.
  reference:
    - https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp
    - https://hackerone.com/reports/2299692
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45648
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-45648
    cwe-id: CWE-444
    epss-score: 0.05883
    epss-percentile: 0.93277
  metadata:
    verified: false
    max-request: 1
    vendor: apache
    product: tomcat
    shodan-query: title:"Apache Tomcat"
    fofa-query: app="APACHE-Tomcat"
  tags: cve,cve2023,apache,tomcat,http-smuggling,passive

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{randstr}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 404'
          - 'contains(body, "Apache Tomcat/")'
          - 'regex("Apache Tomcat/(8\.5\.(0|[1-9]|[1-8][0-9]|9[0-3])|9\.0\.(0(-M\d+)?|[1-9]|[1-7][0-9]|80)|10\.1\.(0(-M\d+)?|[1-9]|1[0-3])|11\.0\.0-M([1-9]|1[01]))(?:[^0-9]|$)", body)'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'Apache Tomcat/([0-9.]+(-M[0-9]+)?)'

References

Use this check only on systems you are authorised to test. Where the data comes from