CVE-2023-45648: Apache Tomcat request smuggling via improper trailer header parsing

CVE-2023-45648 · Severity: medium · CVSS 5.3 · Published 2023-10-10

Apache Tomcat is a widely used web server and application container for Java-based software. A vulnerability in how it handles specific web request headers could allow an attacker to 'smuggle' hidden requests past security filters or reverse proxies. This could lead to unauthorized actions being performed on the server or the bypassing of security controls.

Technologies: org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-coyote (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Maven.

Quick answers

Is CVE-2023-45648 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-45648 being exploited in the wild.
How severe is CVE-2023-45648?
Medium severity, with a CVSS score of 5.3, published 10 October 2023.
Which products and versions are affected?
org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.0-M12; org.apache.tomcat:tomcat-coyote (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.0-M12; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.0-M12.
Is there a fix for CVE-2023-45648?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 11.0.0-M12 or later; org.apache.tomcat:tomcat-coyote (Maven): upgrade to 11.0.0-M12 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.0-M12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-45648 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-45648?
Check whether you run org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-coyote (Maven) or org.apache.tomcat.embed:tomcat-embed-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 11.0.0-M12 or later
    # set org.apache.tomcat:tomcat to 11.0.0-M12 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-coyote (Maven): upgrade to 11.0.0-M12 or later
    # set org.apache.tomcat:tomcat-coyote to 11.0.0-M12 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.0-M12 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 11.0.0-M12 in your pom.xml or build.gradle

Technical details

An improper input validation vulnerability exists in Apache Tomcat's parsing of HTTP trailer headers. By sending a specially crafted, invalid trailer header, a remote attacker can cause Tomcat to misinterpret a single HTTP request as multiple distinct requests. When Tomcat is deployed behind a reverse proxy, this discrepancy in request boundary interpretation enables HTTP request smuggling. The vulnerability affects multiple major versions including 8.5.x, 9.0.x, 10.1.x, and 11.0.x. Users should upgrade to the respective patched versions (8.5.94, 9.0.81, 10.1.14, or 11.0.0-M12) to remediate the issue.

Affected products

  • Apache Tomcat 11.0.0-M1 to 11.0.0-M11, 10.1.0-M1 to 10.1.13, 9.0.0-M1 to 9.0.81, 8.5.0 to 8.5.93

Identifiers

  • CVE-2023-45648
  • GHSA-r6j3-px5g-cq3x

Timeline

  • 2023-10-10: disclosed
  • 2023-10-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.