-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability
Severity: Tomcat 7.0.x - Low, Tomcat 6.0.x - Moderate
Vendor: The Apache Software Foundation
Versions Affected:
Description:
The session list screen (provided by sessionList.jsp) in affected
versions uses the orderBy and sort request parameters without applying
filtering and therefore is vulnerable to a cross-site scripting attack.
Users should be aware that Tomcat 6 does not use httpOnly for session
cookies by default so this vulnerability could expose session cookies
from the manager application to an attacker.
A review of the Manager application by the Apache Tomcat security team
identified additional XSS vulnerabilities if the web applications
deployed were not trusted.
Example:
GET
/manager/html/sessions?path=/&sort="><script>alert('xss')</script>order=ASC&action=injectSessions&refresh=Refresh+Sessions+list
Mitigation:
Users of affected versions should apply one of the following mitigations
No release date has been set for the next Tomcat 7.0.x and Tomcat 6.0.x
releases.
Credit:
The original issue was discovered by Adam Muntner of Gotham Digital Science.
Additional issues were identified by the Tomcat security team as a
result of reviewing the original issue.
References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-6.html
Note: The patches The Apache Tomcat Security Team
Patch for 6.0.29
((HttpServletRequest)
pageContext.getRequest()).getRequestURI() +
"?path=" + path);
%>
<head>
<meta http-equiv="content-type" content="text/html;
charset=iso-8859-1"/>
@@ -45,7 +47,7 @@
<title>Sessions Administration: details for <%= currentSessionId
%></title>
</head>
<body>
<td align="center"><form action="<%= submitUrl %>"><div><input
type="hidden" name="path" value="<%= path %>" /><input type="hidden"
name="action" value="removeSessionAttribute" /><input type="hidden"
name="sessionId" value="<%= currentSessionId %>" /><input type="hidden"
name="attributeName" value="<%= attributeName %>" /><input type="submit"
value="Remove" /></div></form></td>
<td align="center"><form action="<%= submitUrl %>"><div><input
((HttpServletRequest)
pageContext.getRequest()).getRequestURI() +
"?path=" + path);
Collection activeSessions = (Collection)<title>Sessions Administration for <%= path %></title>
<title>Sessions Administration for <%= JspHelper.escapeXml(path)
%></title>
</head>
<body>
<input type="hidden" name="sort" id="sessionsFormSort" value="<%=
(String) request.getAttribute("sort") %>"/>
<input type="hidden" name="sort" id="sessionsFormSort" value="<%=
JspHelper.escapeXml(request.getAttribute("sort")) %>"/>
<% String order = (String) request.getAttribute("order");
if (order == null || "".equals(order)) {
order = "ASC";
}
%>
<input type="hidden" name="order" id="sessionsFormSortOrder"
value="<%= order %>"/>
<input type="hidden" name="order" id="sessionsFormSortOrder"
value="<%= JspHelper.escapeXml(order) %>"/>
<input type="submit" name="refresh" id="refreshButton" value="Refresh
Sessions list"
onclick="document.getElementById('sessionsFormAction').value='refreshSessions';
return true;"/>
<%= JspHelper.formatNumber(activeSessions.size()) %> active Sessions<br/>
<table border="1" cellpadding="2" cellspacing="2" width="100%">
@@ -95,13 +97,13 @@
<% Iterator iter = activeSessions.iterator();
while (iter.hasNext()) {
Session currentSession = (Session) iter.next();
String currentSessionId = currentSession.getId();
String currentSessionId = JspHelper.escapeXml(currentSession.getId());
%>
<tr>
<td>
<td style="text-align: center;"><%=
JspHelper.guessDisplayLocaleFromSession(currentSession) %></td>
<td style="text-align: center;"><%=
JspHelper.escapeXml(JspHelper.guessDisplayLocaleFromSession(currentSession))
%></td>
<td style="text-align: center;"><%=
JspHelper.guessDisplayUserFromSession(currentSession) %></td>
<td style="text-align: center;"><%=
JspHelper.getDisplayCreationTimeForSession(currentSession) %></td>
<td style="text-align: center;"><%=
JspHelper.getDisplayLastAccessedTimeForSession(currentSession) %></td>
Patch for 7.0.4
pageContext.getRequest()).getRequestURL().toString());
((HttpServletRequest)
pageContext.getRequest()).getRequestURI() +
"?path=" + path));
%>
<head>
<meta http-equiv="content-type" content="text/html;
charset=iso-8859-1"/>
@@ -46,7 +47,7 @@
<title>Sessions Administration: details for <%= currentSessionId
%></title>
</head>
<body>
<input type="hidden" name="path" value="<%=
path %>" />
<input type="hidden" name="action"
value="removeSessionAttribute" />
<input type="hidden" name="sessionId"
value="<%= currentSessionId %>" />
<input type="hidden" name="attributeName"
value="<%= attributeName %>" />
<input type="hidden" name="attributeName"
value="<%= JspHelper.escapeXml(attributeName) %>" />
<%
if
("Primary".equals(request.getAttribute("sessionType"))) {
%>
@@ -156,7 +155,6 @@
<form method="post" action="<%=submitUrl%>">
<p style="text-align: center;">
pageContext.getRequest()).getRequestURI() + "?path=" + path);
((HttpServletRequest)
pageContext.getRequest()).getRequestURI() +
"?path=" + path));
Collection activeSessions = (Collection) <input type="hidden" name="sort" id="sessionsFormSort"
value="<%= (String) request.getAttribute("sort") %>"/>
<input type="hidden" name="sort" id="sessionsFormSort"
value="<%= JspHelper.escapeXml(request.getAttribute("sort")) %>"/>
<% String order = (String) request.getAttribute("order");
if (order == null || "".equals(order)) {
order = "ASC";
}
%>
<input type="hidden" name="order" id="sessionsFormSortOrder"
value="<%= order %>"/>
<input type="hidden" name="order" id="sessionsFormSortOrder"
value="<%= JspHelper.escapeXml(order) %>"/>
<input type="submit" name="refresh" id="refreshButton"
value="Refresh Sessions list"
onclick="document.getElementById('sessionsFormAction').value='refreshSessions';
return true;"/>
<%= JspHelper.formatNumber(activeSessions.size()) %> active
Sessions<br/>
<table border="1" cellpadding="2" cellspacing="2" width="100%">
@@ -100,7 +101,7 @@
<% Iterator iter = activeSessions.iterator();
while (iter.hasNext()) {
Session currentSession = (Session) iter.next();
String currentSessionId = currentSession.getId();
String currentSessionId =
JspHelper.escapeXml(currentSession.getId());
String type;
if (currentSession instanceof DeltaSession) {
if (((DeltaSession) currentSession).isPrimarySession()) {
@@ -121,13 +122,13 @@
out.print(currentSessionId);
} else {
%>
<a href="<%= submitUrl
%>&action=sessionDetail&sessionId=<%= currentSessionId
%>&sessionType=<%= type %>"><%=
JspHelper.escapeXml(currentSessionId) %></a>
<a href="<%= submitUrl
%>&action=sessionDetail&sessionId=<%= currentSessionId
%>&sessionType=<%= type %>"><%= currentSessionId %></a>
<%
}
%>
</td>
<td style="text-align: center;"><%= type %></td>
<td style="text-align: center;"><%=
JspHelper.guessDisplayLocaleFromSession(currentSession) %></td>
<td style="text-align: center;"><%=
JspHelper.escapeXml(JspHelper.guessDisplayLocaleFromSession(currentSession))
%></td>
<td style="text-align: center;"><%=
JspHelper.guessDisplayUserFromSession(currentSession) %></td>
<td style="text-align: center;"><%=
JspHelper.getDisplayCreationTimeForSession(currentSession) %></td>
<td style="text-align: center;"><%=
JspHelper.getDisplayLastAccessedTimeForSession(currentSession) %></td>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJM6sBuAAoJEBDAHFovYFnnrHEQAPA2QmgMopWAzEynFt0htLUS
Dx0A8gl4grLLIjDcwCM+jzc44dn0zzSTuXZkhAbCE+gnLpQSCMf1iQmX3hwOKCHx
MgHpWIhpon6FB1+AE3HtqQ2MzH/IUeA0ji2F/nWKors4zdkdpNNZG3O4tNzsd108
IXrDaoJheD0ek9N51PYAuN1ZEhMWnkTYPvpGjCcSn5sj2LYqEGpdrifLBx5QbwZu
eOVJHufomeU6lanogTtSaXUhDmfm0NM72OCxm597R9L10Xll2D2AK0MvTZjWf5Mr
xZiotdlFc6E5PPNtdUOO34HW/ClYrTjWQB1RoY8yUnRjRx8a8tZ+rrX9TCfPuy7x
Os8nOEAjWtUYZmP4I+o0c8tcurpF9gP6rITOL4JZlZPB++ZtzILU4NGzoxsQ5WtZ
U1eIgnH1GcboOAu0TKfxESrDFutruN9PvgIaQPdBftENShk20CNBXfaWatkE0nnv
YZS9R5dviKa/u7cNZEusGQirc65bdDuG2u97bZkqoYyywwpeBC7QKEiPfqnfa9Ju
DkucGnejMDbWa5kgvDQH/i0vnyy2lyknGo/vuZMsgVWffgKQoLG0TLk4hg4Evafv
nWeeepnIdDTTc2KuiqO1F/KSGB7VmR8E2ySGj62g75bJOnSzVMpSpwfF/F7FYMsi
NAKAGVImnKte7ogGqU94
=gjUw
-----END PGP SIGNATURE-----