CVE-2013-2185
published 2014-01-19CVE-2013-2185: The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat…
PriorityP341high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
7.20%
93.6th percentile
The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | <= 7.0.39 | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | jboss_enterprise_portal_platform | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tomcat: remote code execution via uploaded JSP
vendor_redhat·2014-09-10·CVSS 7.5
CVE-2013-4444 [HIGH] tomcat: remote code execution via uploaded JSP
tomcat: remote code execution via uploaded JSP
Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.
Statement: Not Vulnerable. This issue did not affect the versions of Tomcat and JBoss Web as shipped with any Red Hat product, as this flaw was handled by Red Hat as CVE-2013-2185. This flaw is to be considered a duplicate of CVE-2013-4444.
Package: tomcat6 (Red Hat Enterprise Linux 6) - Not affected
Package: tomcat (Red Hat Enterprise Linux 7) - Not affected
Package: jbossweb (Red Hat JBoss Data Grid 6) - Not affected
Package: jbossweb (Red Hat JBoss Data Virtualization 6) - Not affecte
Red Hat
Tomcat/JBossWeb: Arbitrary file upload via deserialization
vendor_redhat·2013-09-03·CVSS 7.5
CVE-2013-2185 [HIGH] CWE-626 Tomcat/JBossWeb: Arbitrary file upload via deserialization
Tomcat/JBossWeb: Arbitrary file upload via deserialization
The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue
It was possible for an attacker, using complex and limited conditions, to upload a malicious JSP to a Tomca
GHSA
Deserialization of Untrusted Data in Apache Tomcat
ghsa·2022-05-17·CVSS 7.5
CVE-2013-2185 [HIGH] CWE-502 Deserialization of Untrusted Data in Apache Tomcat
Deserialization of Untrusted Data in Apache Tomcat
The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.
NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue. Regardless the tomcat maintainers have altered the behavior of this method in version 7.0.39.
OSV
Deserialization of Untrusted Data in Apache Tomcat
osv·2022-05-17·CVSS 7.5
CVE-2013-2185 [HIGH] Deserialization of Untrusted Data in Apache Tomcat
Deserialization of Untrusted Data in Apache Tomcat
The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.
NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue. Regardless the tomcat maintainers have altered the behavior of this method in version 7.0.39.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-4444 tomcat: remote code execution via uploaded JSP [epel-6]
bugzilla·2014-09-10·CVSS 7.5
CVE-2013-4444 [HIGH] CVE-2013-4444 tomcat: remote code execution via uploaded JSP [epel-6]
CVE-2013-4444 tomcat: remote code execution via uploaded JSP [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
epel-6 tracking bug for tomcat: see blocks bug list for ful
Bugzilla
CVE-2013-4444 tomcat: remote code execution via uploaded JSP
bugzilla·2014-09-10·CVSS 6.8
CVE-2013-4444 [MEDIUM] CVE-2013-4444 tomcat: remote code execution via uploaded JSP
CVE-2013-4444 tomcat: remote code execution via uploaded JSP
As reported fixed in Apache Tomcat 7.0.40 [1]:
In very limited circumstances, it was possible for an attacker to upload a malicious JSP to a Tomcat server and then trigger the execution of that JSP. While Remote Code Execution would normally be viewed as a critical vulnerability, the circumstances under which this is possible are, in the view of the Tomcat security team, sufficiently limited that this vulnerability is viewed as important.
For this attack to succeed all of the following requirements must be met:
1. Using Oracle Java 1.7.0 update 25 or earlier (or any other Java implementation where java.io.File is vulnerable to null byte injection).
2. A web application must be deployed to a vulnerable version of Tomcat.
3. Th
Bugzilla
CVE-2013-2185 Tomcat/JBossWeb: Arbitrary file upload via deserialization
bugzilla·2013-06-16·CVSS 7.5
CVE-2013-2185 [HIGH] CVE-2013-2185 Tomcat/JBossWeb: Arbitrary file upload via deserialization
CVE-2013-2185 Tomcat/JBossWeb: Arbitrary file upload via deserialization
A poison null byte flaw was found in the implementation of the DiskFileItem class. A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is permitted by the user running the application server process.
Discussion:
The Apache Tomcat team does not agree that this is a valid security flaw; they contend that an application performing untrusted deserialization is inherently insecure. However, the issue has been fixed as a code cleanup in this commit:
http://svn.apache.org/viewvc?view=revision&revision=1470435
---
This issue has been addressed in following products:
Red
http://openwall.com/lists/oss-security/2014/10/24/12http://rhn.redhat.com/errata/RHSA-2013-1193.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1194.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1265.htmlhttp://www.openwall.com/lists/oss-security/2013/09/05/4http://openwall.com/lists/oss-security/2014/10/24/12http://rhn.redhat.com/errata/RHSA-2013-1193.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1194.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1265.htmlhttp://www.openwall.com/lists/oss-security/2013/09/05/4
2014-01-19
Published