cbcvebase.
CVE-2018-11784
published 2018-10-04

CVE-2018-11784: When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g…

PriorityP350medium4.3CVSS 3.0
AVNACLPRNUIRSUCNILAN
EXPLOIT
EPSS
94.49%
99.8th percentile
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Affected

31 ranges· showing 25
VendorProductVersion rangeFixed in
apachetomcat
apachetomcat
apachetomcat7.0.23 – 7.0.90
apachetomcat8.5.0 – 8.5.33
apachetomcat9.0.1 – 9.0.11
apache_software_foundationapache_tomcat
apache_software_foundationapache_tomcat
apache_software_foundationapache_tomcat
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debiantomcat9
hynmulti-tenant>= 5.6.0 < 5.7.25.7.2
oraclecommunications_application_session_controller
oraclecommunications_application_session_controller
oraclehospitality_guest_access
oraclehospitality_guest_access
oracleinstantis_enterprisetrack
oracleinstantis_enterprisetrack
oracleinstantis_enterprisetrack
oracleretail_order_broker
oracleretail_order_broker
oracleretail_order_broker
oraclesecure_global_desktop
redhatenterprise_linux_desktop

Detection & IOCsextracted from sources · hover to see the quote

url{{BaseURL}}//interact.sh
urlhttp://example.com//test
  • Trigger the vulnerability by requesting a path with at least 2 leading slashes before a valid subfolder and no trailing slash; the server will redirect to an attacker-controlled URI
  • The vulnerability is triggered via the default servlet when a directory redirect is issued; monitor for redirect responses (3xx) to URIs not matching the application's own domain
  • Confirm the redirect result: browsing to the crafted double-slash URL causes the application to redirect to the attacker-supplied host (e.g. http://test/)
  • ·Affected versions are Apache Tomcat 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33, and 7.0.23 to 7.0.90; fixed in 9.0.12, 8.5.34, and 7.0.91 respectively
  • ·The vulnerability only manifests when the default servlet performs a directory redirect; a valid subfolder must exist in the application for the crafted URL to trigger the redirect
  • ·The Nuclei template checks that the response is NOT a 404, meaning the path segment used in the probe must resolve to an existing resource on the target

CVSS provenance

nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa4.3MEDIUM
osv4.3MEDIUM
vendor_apache4.3MEDIUM
vendor_debian4.3LOW
vendor_redhat4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.