I am facing Apache Tomcat examples directory vulnerabilities in one of the scenario, what I use the pattern '..;' in url relaive path as below: https://website.com/..;/manager/html as it's a servlet based application, The issue occurs when I use '..;' or any pattern preceded by '..;' https://website.com/..;..=../manager/html I can resolve it by settings of listings parameter in <CATALINA_HOME>\conf\web.xml'. Other than this resolution, how can we eliminate semicolon OR the patter '..;' in the URL.
0
votes
which exact version of tomcat? And does this appear in Tomcat's stock code or is that in your own application? Proper handling of parameters typically falls into the hands of the application developer and you can't "eliminate" them from the URL, as that's what your client sends: You'll have to handle them properly.
- Olaf Kock
Hi @OlafKock, Thank you , before reaching the request to the corresponding servlet file, due to the relative url pattern '..;' it could access the default directories in tomcat eben the listings is FALSE. Below xml might be helpful to answer. <web-app version="2.5" ...> <servlet> <servlet-name>default</servlet-name> <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class> +<init-param> -<init-param> <param-name>listings</param-name> <param-value>false</param-value> </init-param> <load-on-startup>1</load-on-startup> </servlet> </web-app>
- Prabha
...if you edit this into your question, you can even use formatting, and it will become readable... Also: Please mention the exact version of tomcat that you're using (make sure it's not an ancient one please - otherwise check if it's long been fixed). Note that in case this is a security-relevant issue on the latest release of a supported version, it'd be nice to not disclose it publicly, but directly to the developers.
- Olaf Kock
Hi @OlafKock, tomcat version is apache-tomcat-6.0.37, I will provide details by editing the question, but here I could not understand the pattern of '..;' , If the url contains this pattern then only it can access the admin manager.html file website.com/..;..=../manager/html, for suppose if it is 'website.com/.;..=../manager/html' (the pattern is '.;'), it can not be able to access manager/html directory.
- Prabha
Hi, can we restrict apache tomcat ui access for admin manager/html folder iff the url has localhost:8080/manager/html, in my case the other issue is the folder manager/html can be accessible from webaddress.com/..;/manager/html other than local host. Please suggest.
- Prabha
1 Answers
2
votes
You're running a version that was released in 2013 of a branch (6.0.x) that has reached its end of life in 2016. Since then, lots of security issues have been fixed.
The only sensible recommendation is to upgrade to a version that is still being maintained (eg Tomcat 9), and never again let yourself get so horribly behind the times again, especially on server side software.
You might want to try if 6.0.53 fixes this particular issue, but it is not a long term solution, just a quick way to try fixing this particular issue that you're aware of before you finally do a major version upgrade, to fix all of the issues that you're not aware of yet:
