pa55w0rd/cve-2018-1305Apache Tomcat 安全绕过漏洞 Poc
Recently, Apache released a security advisory stating that multiple versions of Apache Tomcat 7, 8, and 9 have a security bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized operations, which may aid further attacks.
Security constraints defined by Apache Tomcat servlet annotations are applied only once after the servlet is loaded. Because constraints defined in this way apply to the URL pattern and any URLs under that point, it likely depends on the order of servlet loading, which may expose resources to users without authorization to access them.
CVE-2018-1305
Apache Tomcat < 9.0.5
Apache Tomcat < 8.5.28
Apache Tomcat < 8.0.50
Apache Tomcat < 7.0.85
Medium
Java EE provides the ServletSecurity annotation similar to ACL permission checks, which can be used to decorate Servlets for protection. If there are two servlets, Servlet1 with access path "/servlet1/" and added ServletSecurity annotation, and Servlet2 with access path "/servlet1/servlet2/" but without ServletSecurity annotation, when first accessing servlet1/servlet2, the ServletSecurity annotation of servlet1 will not take effect and cannot protect the "/servlet1/servlet2" path, thus may lead to unauthorized access.
If "/servlet1" is accessed before "/servlet1/servlet2", Tomcat will load the ACL and start protecting "/servlet1/servlet2", so the vulnerability will not be triggered.
Add ServletSecurity annotation to Servlet1, Servlet2 has no such annotation.
Modify the url-pattern corresponding to the servlet in the web.xml file as shown in the image below.
Run the project. When first accessing the URL of servlet2, it is found that unauthorized access is possible, the ACL for servlet1 has not taken effect.
When accessing the URL of servlet1 the second time, access is denied, and the ACL takes effect.
Access the URL of servlet2 again, and find that access is denied. For the ACL to take effect on servlet2, it must be based on the premise that servlet1 has been accessed.
Therefore, the reproduction of the vulnerability is limited to the condition that after Tomcat starts, the "/servlet1/servlet2/" page is accessed before accessing "/servlet1/". If anyone had previously accessed the "/servlet1/*" page, the vulnerability would not be triggered. The vulnerability is highly harmful, but the exploitation conditions are difficult, so the scope of impact is not large.
