CVE-2018-1323
published 2018-03-12CVE-2018-1323: The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map…
PriorityP265high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
44.24%
98.6th percentile
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat_jk_connector | 1.2.0 – 1.2.42 | — |
| apache | tomcat_jk_connector | 1.2.0 – 1.2.44 | — |
| apache_software_foundation | apache_tomcat_connectors | — | — |
| apache_software_foundation | apache_tomcat_connectors | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libapache-mod-jk | < libapache-mod-jk 1:1.2.46-1 (bookworm) | libapache-mod-jk 1:1.2.46-1 (bookworm) |
| debian | libapache-mod-jk | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for HTTP responses containing 'JK Status Manager' with a 200 status code, indicating exposed jkstatus endpoint accessible without authentication. ↗
- →Probe both /jkstatus and /jkstatus; (with trailing semicolon) as the path normalization flaw may allow the semicolon variant to bypass access controls. ↗
- →The vulnerability resides in IIS/ISAPI-specific path normalization code (jk_isapi_plugin.c); monitor IIS logs for specially constructed requests targeting URI paths that should be restricted by the URI-worker map. ↗
- →Flag requests where path normalization edge cases could expose Tomcat application functionality not intended to be reachable via the reverse proxy — particularly requests with semicolons or unusual path encodings. ↗
- ·The vulnerability only affects deployments where only a sub-set of Tomcat URLs are exposed via IIS; if all Tomcat URLs are exposed through IIS, the path normalization bypass has no additional impact. ↗
- ·CVE-2018-1323 is specific to the IIS/ISAPI connector (isapi_redirect / jk_isapi_plugin.c); it is distinct from CVE-2018-11759 which affects the Apache httpd (mod_jk) connector — do not conflate detection or remediation between the two. ↗
- ·Red Hat JBoss Web Server 2 (mod_jk / isapi_redirect) is marked 'Will not fix' — affected deployments on that platform will not receive a vendor patch. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vulncheck7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mod_jk: connector path traversal due to mishandled HTTP requests in httpd
vendor_redhat·2018-10-31·CVSS 7.5
CVE-2018-11759 [HIGH] CWE-22 mod_jk: connector path traversal due to mishandled HTTP requests in httpd
mod_jk: connector path traversal due to mishandled HTTP requests in httpd
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
Package: m
Red Hat
isapi_redirect: Mishandled HTTP request paths in jk_isapi_plugin.c can lead to unintended exposure of application resources via the reverse proxy
vendor_redhat·2018-03-13·CVSS 7.5
CVE-2018-1323 [HIGH] CWE-22 isapi_redirect: Mishandled HTTP request paths in jk_isapi_plugin.c can lead to unintended exposure of application resources via the reverse proxy
isapi_redirect: Mishandled HTTP request paths in jk_isapi_plugin.c can lead to unintended exposure of application resources via the reverse proxy
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.
Package: isapi_redirect (Red Hat JBoss Core Services) - Affected
Package: web (Red Hat JBoss Enterprise Application Platform 6) - Affected
Package: web (Red Hat JBoss Enterprise Web S
Debian
CVE-2018-11759: libapache-mod-jk - The Apache Web Server (httpd) specific code that normalised the requested path b...
vendor_debian·2018·CVSS 7.5
CVE-2018-11759 [HIGH] CVE-2018-11759: libapache-mod-jk - The Apache Web Server (httpd) specific code that normalised the requested path b...
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
Scope: local
bookworm: resolved (fixed in 1:1.2.46-1)
bullseye: resolved (fixed in 1:1
Debian
CVE-2018-1323: libapache-mod-jk - The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2...
vendor_debian·2018·CVSS 7.5
CVE-2018-1323 [HIGH] CVE-2018-1323: libapache-mod-jk - The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2...
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-5q2c-33mg-8m75: The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) C
ghsa_unreviewed·2022-05-14·CVSS 7.5
CVE-2018-11759 [HIGH] CWE-22 GHSA-5q2c-33mg-8m75: The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) C
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
GHSA
GHSA-jxj8-3w7h-p8mx: The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1
ghsa_unreviewed·2022-05-14
CVE-2018-1323 [HIGH] CWE-22 GHSA-jxj8-3w7h-p8mx: The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.
OSV
CVE-2018-11759: The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) C
osv·2018-10-31·CVSS 7.5
CVE-2018-11759 [HIGH] CVE-2018-11759: The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) C
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
VulnCheck
Apache Tomcat Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2018·CVSS 7.5
CVE-2018-11759 [HIGH] Apache Tomcat Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Apache Tomcat Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not ide
No detection rules found.
Exploit-DB
Skia and Firefox - Integer Overflow in SkTDArray Leading to Out-of-Bounds Write
exploitdb·2018-05-25
CVE-2018-5159 Skia and Firefox - Integer Overflow in SkTDArray Leading to Out-of-Bounds Write
Skia and Firefox - Integer Overflow in SkTDArray Leading to Out-of-Bounds Write
---
#include "SkCanvas.h"
#include "SkPath.h"
#include "SkGradientShader.h"
#include "SkBitmap.h"
#include "SkDashPathEffect.h"
int main (int argc, char * const argv[]) {
SkBitmap bitmap;
bitmap.allocN32Pixels(500, 500);
//Create Canvas
SkCanvas canvas(bitmap);
SkPaint p;
p.setAntiAlias(false);
float intervals[] = { 0, 10e9f };
p.setStyle(SkPaint::kStroke_Style);
p.setPathEffect(SkDashPathEffect::Make(intervals, SK_ARRAY_COUNT(intervals), 0));
SkPath path;
unsigned quadraticarr[] = {13, 68, 258, 1053, 1323, 2608, 10018, 15668, 59838, 557493, 696873, 871098, 4153813, 15845608, 48357008, 118059138, 288230353, 360287948, 562949933, 703687423, 1099511613, 0};
path.moveTo(0, 0);
unsigned numpoints = 1;
unsi
Nuclei
Apache Tomcat JK Connect <=1.2.44 - Manager Access
nuclei·CVSS 7.5
CVE-2018-11759 [HIGH] Apache Tomcat JK Connect <=1.2.44 - Manager Access
Apache Tomcat JK Connect <=1.2.44 - Manager Access
Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
Template:
id: CVE-2018-11759
info:
name: Apache Tomcat JK Connect <=1.2.44 - Manager Access
author: harshbothra_
severity: high
description: |
Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed reque
Bugzilla
CVE-2018-11759 mod_jk: connector path traversal due to mishandled HTTP requests in httpd
bugzilla·2018-11-02·CVSS 7.5
CVE-2018-11759 [HIGH] CVE-2018-11759 mod_jk: connector path traversal due to mishandled HTTP requests in httpd
CVE-2018-11759 mod_jk: connector path traversal due to mishandled HTTP requests in httpd
A flaw was found in Apache Tomcat JK mod_jk Connector 1.2.0 to 1.2.44. The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap bet
Bugzilla
CVE-2018-1323 isapi_redirect: Mishandled HTTP request paths in jk_isapi_plugin.c can lead to unintended exposure of application resources via the reverse proxy
bugzilla·2018-03-13·CVSS 7.5
CVE-2018-1323 [HIGH] CVE-2018-1323 isapi_redirect: Mishandled HTTP request paths in jk_isapi_plugin.c can lead to unintended exposure of application resources via the reverse proxy
CVE-2018-1323 isapi_redirect: Mishandled HTTP request paths in jk_isapi_plugin.c can lead to unintended exposure of application resources via the reverse proxy
The ISAPI redirector code in Apache Tomcat JK Connector before version 1.2.43 does not properly handle HTTP request paths in certain edge cases. A remote attacker could exploit this by sending a crafted request to expose application functionality through the reverse proxy.
External References:
http://tomcat.apache.org/security-jk.html#Fixed_in_Apache_Tomcat_JK_Connector_1.2.43
Upstream Patch:
http://svn.apache.org/viewvc?view=revision&revision=1825658
Discussion:
This issue has been addressed in the following products:
Red Hat JBoss Core Services
Via RHSA-2018:1843 https://access.redhat.com/errata/RHSA-2018:1843
http://www.securityfocus.com/bid/103389https://access.redhat.com/errata/RHSA-2018:1843https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/6e146bce83578bd870893250ba8354e28f9d8e86c674c30dbeee529f%40%3Cannounce.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3Ehttp://www.securityfocus.com/bid/103389https://access.redhat.com/errata/RHSA-2018:1843https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/6e146bce83578bd870893250ba8354e28f9d8e86c674c30dbeee529f%40%3Cannounce.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E
2018-03-12
Published