CVE-2023-45648: Apache Tomcat request smuggling via improper trailer header parsing

Executive brief

Apache Tomcat is a widely used web server and application container for Java-based software. A vulnerability in how it handles specific web request headers could allow an attacker to 'smuggle' hidden requests past security filters or reverse proxies. This could lead to unauthorized actions being performed on the server or the bypassing of security controls.

Technical details

An improper input validation vulnerability exists in Apache Tomcat's parsing of HTTP trailer headers. By sending a specially crafted, invalid trailer header, a remote attacker can cause Tomcat to misinterpret a single HTTP request as multiple distinct requests. When Tomcat is deployed behind a reverse proxy, this discrepancy in request boundary interpretation enables HTTP request smuggling. The vulnerability affects multiple major versions including 8.5.x, 9.0.x, 10.1.x, and 11.0.x. Users should upgrade to the respective patched versions (8.5.94, 9.0.81, 10.1.14, or 11.0.0-M12) to remediate the issue.

Affected products

• Apache Tomcat 11.0.0-M1 to 11.0.0-M11, 10.1.0-M1 to 10.1.13, 9.0.0-M1 to 9.0.81, 8.5.0 to 8.5.93

Timeline

• 2023-10-10: disclosed
• 2023-10-10: advisory

References

• https://api.github.com/users/biehl1
• https://github.com/biehl1
• https://api.github.com/users/biehl1/gists%7B/gist_id%7D
• https://api.github.com/users/biehl1/repos
• https://avatars.githubusercontent.com/u/92224808?v=4
• https://api.github.com/users/biehl1/events%7B/privacy%7D