CVE-2018-1304 Apache Tomcat unauthorized access vulnerability
Attackers can bypass security constraints to access protected web application resources when the URL pattern is an empty string.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1304?
CVE-2018-1304 is a medium-severity missing authorization vulnerability in Apache Tomcat, published on 28 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
Which versions are affected by CVE-2018-1304?
8 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core. It affects 10 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 | 7.0.86 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 | 7.0.86 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.0.0 | 8.0.51 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.0.0 | 8.0.51 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 | 8.5.28 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 | 8.5.28 |
2 more packages
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0 | 9.0.5 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0 | 9.0.5 |
Products include Apache Tomcat, Canonical Ubuntu Linux, Debian Debian Linux, Oracle Fusion Middleware, Oracle Hospitality Guest Access, Oracle Micros Relate Crm Software and 4 more.
How do I fix CVE-2018-1304?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 7.0.86, 8.0.51, 8.5.28 or 9.0.5.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-1304 being exploited?
There is no known exploitation of CVE-2018-1304 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as GHSA-6rxj-58jh-436r, UBUNTU-CVE-2018-1304.