Path traversal in Apache Tomcat JK ISAPI Connector - CVE-2018-11759

Vulnerability identifier: #VU15703

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-11759

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform path traversal attacks.

The vulnerability exists due to input validation error when matching requested path against URI-worker map in Apache Tomcat JK (mod_jk) Connector within the Apache Web Server (httpd) specific code. A remote attacker can send a specially crafted HTTP request to the affected system and expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy.

Apache Tomcat JK ISAPI Connector
Debian Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Opensuse
Server Applications Module
openSUSE Leap
apache2-mod_jk-debuginfo
apache2-mod_jk-debugsource
apache2-mod_jk

Install updates from vendor's website.

Apache Tomcat JK ISAPI Connector - update to 1.2.46
apache2-mod_jk-debuginfo - update to 1.2.49-150100.6.6.1
apache2-mod_jk-debugsource - update to 1.2.49-150100.6.6.1
apache2-mod_jk - update to 1.2.49-150100.6.6.1

• Exploit #2361 - CVE-2018-11759 (Proof of concept showing how to exploit the CVE-2018-11759) (April 7, 2020)
• Exploit #1973 - Identificador-CVE-2018-11759 (This exploit for CVE 2018-11759, vulnerability in apache mod_jk, module for load-balancer) (March 18, 2020)

• https://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad@%3Cannounce.tomcat.apache.org%3E
• https://tomcat.apache.org/security-jk.html

• Path traversal in Apache Tomcat JK Connector
• OpenSUSE Linux update for apache2-mod
• Debian update for libapache-mod-jk
• SUSE update for apache2-mod_jk