-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability Severity: Tomcat 7.0.x - Low, Tomcat 6.0.x - Moderate Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.4 - Not affected in default configuration. - Affected if CSRF protection is disabled - Additional XSS issues if web applications are untrusted - - Tomcat 6.0.12 to 6.0.29 - Affected in default configuration - Additional XSS issues if web applications are untrusted - - Tomcat 5.5.x - Not affected Description: The session list screen (provided by sessionList.jsp) in affected versions uses the orderBy and sort request parameters without applying filtering and therefore is vulnerable to a cross-site scripting attack. Users should be aware that Tomcat 6 does not use httpOnly for session cookies by default so this vulnerability could expose session cookies from the manager application to an attacker. A review of the Manager application by the Apache Tomcat security team identified additional XSS vulnerabilities if the web applications deployed were not trusted. Example: GET /manager/html/sessions?path=/&sort=">order=ASC&action=injectSessions&refresh=Refresh+Sessions+list Mitigation: Users of affected versions should apply one of the following mitigations - - Tomcat 7.0.0 to 7.0.4 - Remove the Manager application - Remove the sessionList.jsp and sessionDetail.jsp files - Ensure the CSRF protection is enabled - Apply the patch 7.0.4 patch (see below) - Update to 7.0.5 when released - - Tomcat 6.0.12 to 6.0.29 - Remove the Manager application - Remove the sessionList.jsp and sessionDetail.jsp files - Apply the patch for 6.0.29 (see below) - Update to 6.0.30 when released No release date has been set for the next Tomcat 7.0.x and Tomcat 6.0.x releases. Credit: The original issue was discovered by Adam Muntner of Gotham Digital Science. Additional issues were identified by the Tomcat security team as a result of reviewing the original issue. References: http://tomcat.apache.org/security.html http://tomcat.apache.org/security-7.html http://tomcat.apache.org/security-6.html Note: The patches The Apache Tomcat Security Team **************** Patch for 6.0.29 **************** Index: webapps/manager/WEB-INF/jsp/sessionDetail.jsp =================================================================== - --- webapps/manager/WEB-INF/jsp/sessionDetail.jsp (revision 1037769) +++ webapps/manager/WEB-INF/jsp/sessionDetail.jsp (working copy) @@ -30,8 +30,10 @@ <% String path = (String) request.getAttribute("path"); Session currentSession = (Session)request.getAttribute("currentSession"); HttpSession currentHttpSession = currentSession.getSession(); - - String currentSessionId = currentSession.getId(); - - String submitUrl = ((HttpServletRequest)pageContext.getRequest()).getRequestURL().toString(); + String currentSessionId = JspHelper.escapeXml(currentSession.getId()); + String submitUrl = JspHelper.escapeXml( + ((HttpServletRequest) pageContext.getRequest()).getRequestURI() + + "?path=" + path); %> @@ -45,7 +47,7 @@ Sessions Administration: details for <%= currentSessionId %> - -

Details for Session <%= JspHelper.escapeXml(currentSessionId) %>

+

Details for Session <%= currentSessionId %>

@@ -54,7 +56,7 @@ - - + @@ -120,7 +122,7 @@ String attributeName = (String) attributeNamesEnumeration.nextElement(); %> - - + Index: webapps/manager/WEB-INF/jsp/sessionsList.jsp =================================================================== - --- webapps/manager/WEB-INF/jsp/sessionsList.jsp (revision 1037769) +++ webapps/manager/WEB-INF/jsp/sessionsList.jsp (working copy) @@ -26,7 +26,9 @@ <% String path = (String) request.getAttribute("path"); - - String submitUrl = ((HttpServletRequest)pageContext.getRequest()).getRequestURI() + "?path=" + path; + String submitUrl = JspHelper.escapeXml( + ((HttpServletRequest) pageContext.getRequest()).getRequestURI() + + "?path=" + path); Collection activeSessions = (Collection) request.getAttribute("activeSessions"); %> @@ -38,10 +40,10 @@ - - Sessions Administration for <%= path %> + Sessions Administration for <%= JspHelper.escapeXml(path) %> - -

Sessions Administration for <%= path %>

+

Sessions Administration for <%= JspHelper.escapeXml(path) %>

Tips:

Guessed Locale<%= JspHelper.guessDisplayLocaleFromSession(currentSession) %><%= JspHelper.escapeXml(JspHelper.guessDisplayLocaleFromSession(currentSession)) %>
Guessed User
 <%= JspHelper.escapeXml(attributeName) %> <% Object attributeValue = currentHttpSession.getAttribute(attributeName); %>"><%= JspHelper.escapeXml(attributeValue) %>
@@ -95,13 +97,13 @@ <% Iterator iter = activeSessions.iterator(); while (iter.hasNext()) { Session currentSession = (Session) iter.next(); - - String currentSessionId = currentSession.getId(); + String currentSessionId = JspHelper.escapeXml(currentSession.getId()); %> - - + *************** Patch for 7.0.4 *************** Index: webapps/manager/WEB-INF/jsp/sessionDetail.jsp =================================================================== - --- webapps/manager/WEB-INF/jsp/sessionDetail.jsp (revision 1037768) +++ webapps/manager/WEB-INF/jsp/sessionDetail.jsp (working copy) @@ -30,9 +30,10 @@ <% String path = (String) request.getAttribute("path"); Session currentSession = (Session)request.getAttribute("currentSession"); HttpSession currentHttpSession = currentSession.getSession(); - - String currentSessionId = currentSession.getId(); - - String submitUrl = response.encodeURL(((HttpServletRequest) - - pageContext.getRequest()).getRequestURL().toString()); + String currentSessionId = JspHelper.escapeXml(currentSession.getId()); + String submitUrl = JspHelper.escapeXml(response.encodeURL( + ((HttpServletRequest) pageContext.getRequest()).getRequestURI() + + "?path=" + path)); %> @@ -46,7 +47,7 @@ Sessions Administration: details for <%= currentSessionId %> - -

Details for Session <%= JspHelper.escapeXml(currentSessionId) %>

+

Details for Session <%= currentSessionId %>

- -<%= JspHelper.escapeXml(currentSessionId) %> +<%= currentSessionId %> <%= JspHelper.guessDisplayLocaleFromSession(currentSession) %><%= JspHelper.escapeXml(JspHelper.guessDisplayLocaleFromSession(currentSession)) %> <%= JspHelper.guessDisplayUserFromSession(currentSession) %> <%= JspHelper.getDisplayCreationTimeForSession(currentSession) %> <%= JspHelper.getDisplayLastAccessedTimeForSession(currentSession) %>
@@ -55,7 +56,7 @@ - - + @@ -89,7 +90,6 @@
- - @@ -131,10 +131,9 @@
Guessed Locale<%= JspHelper.guessDisplayLocaleFromSession(currentSession) %><%= JspHelper.escapeXml(JspHelper.guessDisplayLocaleFromSession(currentSession)) %>
Guessed User
- - - - + <% if ("Primary".equals(request.getAttribute("sessionType"))) { %> @@ -156,7 +155,6 @@

- -

Index: webapps/manager/WEB-INF/jsp/sessionsList.jsp =================================================================== - --- webapps/manager/WEB-INF/jsp/sessionsList.jsp (revision 1037768) +++ webapps/manager/WEB-INF/jsp/sessionsList.jsp (working copy) @@ -28,8 +28,9 @@ <%@page import="org.apache.catalina.manager.DummyProxySession"%> <% String path = (String) request.getAttribute("path"); - - String submitUrl = response.encodeURL(((HttpServletRequest) - - pageContext.getRequest()).getRequestURI() + "?path=" + path); + String submitUrl = JspHelper.escapeXml(response.encodeURL( + ((HttpServletRequest) pageContext.getRequest()).getRequestURI() + + "?path=" + path)); Collection activeSessions = (Collection) request.getAttribute("activeSessions"); %> @@ -41,10 +42,10 @@ - - Sessions Administration for <%= path %> + Sessions Administration for <%= JspHelper.escapeXml(path) %> - -

Sessions Administration for <%= path %>

+

Sessions Administration for <%= JspHelper.escapeXml(path) %>

Tips:

    @@ -58,13 +59,13 @@
    Active HttpSessions informations - - "/> + "/> <% String order = (String) request.getAttribute("order"); if (order == null || "".equals(order)) { order = "ASC"; } %> - - + <%= JspHelper.formatNumber(activeSessions.size()) %> active Sessions
    @@ -100,7 +101,7 @@ <% Iterator iter = activeSessions.iterator(); while (iter.hasNext()) { Session currentSession = (Session) iter.next(); - - String currentSessionId = currentSession.getId(); + String currentSessionId = JspHelper.escapeXml(currentSession.getId()); String type; if (currentSession instanceof DeltaSession) { if (((DeltaSession) currentSession).isPrimarySession()) { @@ -121,13 +122,13 @@ out.print(currentSessionId); } else { %> - - <%= JspHelper.escapeXml(currentSessionId) %> + <%= currentSessionId %> <% } %> - - + -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJM6sBuAAoJEBDAHFovYFnnrHEQAPA2QmgMopWAzEynFt0htLUS Dx0A8gl4grLLIjDcwCM+jzc44dn0zzSTuXZkhAbCE+gnLpQSCMf1iQmX3hwOKCHx MgHpWIhpon6FB1+AE3HtqQ2MzH/IUeA0ji2F/nWKors4zdkdpNNZG3O4tNzsd108 IXrDaoJheD0ek9N51PYAuN1ZEhMWnkTYPvpGjCcSn5sj2LYqEGpdrifLBx5QbwZu eOVJHufomeU6lanogTtSaXUhDmfm0NM72OCxm597R9L10Xll2D2AK0MvTZjWf5Mr xZiotdlFc6E5PPNtdUOO34HW/ClYrTjWQB1RoY8yUnRjRx8a8tZ+rrX9TCfPuy7x Os8nOEAjWtUYZmP4I+o0c8tcurpF9gP6rITOL4JZlZPB++ZtzILU4NGzoxsQ5WtZ U1eIgnH1GcboOAu0TKfxESrDFutruN9PvgIaQPdBftENShk20CNBXfaWatkE0nnv YZS9R5dviKa/u7cNZEusGQirc65bdDuG2u97bZkqoYyywwpeBC7QKEiPfqnfa9Ju DkucGnejMDbWa5kgvDQH/i0vnyy2lyknGo/vuZMsgVWffgKQoLG0TLk4hg4Evafv nWeeepnIdDTTc2KuiqO1F/KSGB7VmR8E2ySGj62g75bJOnSzVMpSpwfF/F7FYMsi NAKAGVImnKte7ogGqU94 =gjUw -----END PGP SIGNATURE-----
    <%= type %><%= JspHelper.guessDisplayLocaleFromSession(currentSession) %><%= JspHelper.escapeXml(JspHelper.guessDisplayLocaleFromSession(currentSession)) %> <%= JspHelper.guessDisplayUserFromSession(currentSession) %> <%= JspHelper.getDisplayCreationTimeForSession(currentSession) %> <%= JspHelper.getDisplayLastAccessedTimeForSession(currentSession) %>