CVE-2019-0221: Apache Tomcat XSS in SSI printenv command

Executive brief

Apache Tomcat is a widely used web server and application container for Java-based websites. A security flaw in its Server Side Includes (SSI) debugging tool allows attackers to inject malicious scripts into a user's browser session. While this tool is disabled by default and rarely used in production, an exploit could lead to unauthorized actions or data theft from users visiting a compromised page.

Technical details

A cross-site scripting (CWE-79) vulnerability exists in the SSI 'printenv' command of Apache Tomcat. The root cause is the failure to neutralize or escape user-controllable input before it is echoed back in the web page output. An unauthenticated remote attacker can exploit this by tricking a user into visiting a URL that triggers the printenv command with malicious parameters. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session. This feature is disabled by default and typically used only for debugging. Patches are available in versions 7.0.94, 8.5.40, and 9.0.17.

Affected products

• Apache Tomcat 7.0.0 to 7.0.93, 8.5.0 to 8.5.39, 9.0.0.M1 to 9.0.0.17

Timeline

• 2019-05-28: advisory: NVD publication date
• 2019-05-30: disclosed: GitHub Advisory Database publication date

References

• https://api.github.com/users/sunSUNQ
• https://github.com/sunSUNQ
• https://api.github.com/users/sunSUNQ/gists%7B/gist_id%7D
• https://api.github.com/users/sunSUNQ/repos
• https://avatars.githubusercontent.com/u/33311698?v=4
• https://api.github.com/users/sunSUNQ/events%7B/privacy%7D