nuclei-templates/cves/2018/CVE-2018-11759.yaml

id: CVE-2018-11759

info:
  name: Apache Tomcat JK Status Manager Access
  author: harshbothra_
  severity: high
  reference: https://github.com/immunIT/CVE-2018-11759
  tags: cve,cve2018,apache
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.50
    cve-id: CVE-2018-11759
    cwe-id: CWE-22
  description: "The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical."

requests:
  - method: GET
    path:
      - '{{BaseURL}}/jkstatus'
      - '{{BaseURL}}/jkstatus;'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "JK Status Manager"
misc changes 2021-01-02 05:00:39 +00:00			`id: CVE-2018-11759`
Create CVE-2018-11759.yaml Apache Tomcat JK Status Manager Access 2020-07-06 16:28:42 +00:00
			`info:`
			`name: Apache Tomcat JK Status Manager Access`
Updated author names 2021-06-09 12:20:56 +00:00			`author: harshbothra_`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`severity: high`
Added tags to cves :sunglasses: (#813) * Added tags to cves :sunglasses: 2021-02-05 19:44:41 +00:00			`reference: https://github.com/immunIT/CVE-2018-11759`
			`tags: cve,cve2018,apache`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
			`cvss-score: 7.50`
			`cve-id: CVE-2018-11759`
			`cwe-id: CWE-22`
			description: "The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical."
Create CVE-2018-11759.yaml Apache Tomcat JK Status Manager Access 2020-07-06 16:28:42 +00:00
			`requests:`
			`- method: GET`
			`path:`
adding both path for possilbe use cases 2020-08-06 08:12:12 +00:00			`- '{{BaseURL}}/jkstatus'`
Add semicolon to path The vulnerability is that access restriction can be circumvented by adding a semicolon to the path (as pointed out in https://github.com/immunIT/CVE-2018-11759). Without semicolon, jkstatus would be public anyway and would not be related to the CVE. 2020-08-06 08:06:13 +00:00			`- '{{BaseURL}}/jkstatus;'`
Create CVE-2018-11759.yaml Apache Tomcat JK Status Manager Access 2020-07-06 16:28:42 +00:00
Update CVE-2018-11759.yaml 2020-07-06 17:13:45 +00:00			`matchers-condition: and`
Create CVE-2018-11759.yaml Apache Tomcat JK Status Manager Access 2020-07-06 16:28:42 +00:00			`matchers:`
			`- type: status`
			`status:`
			`- 200`
			`- type: word`
			`words:`
			`- "JK Status Manager"`