Apache Tomcat JK Status Manager Access

Description

In Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44, the Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. It was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy if only a subset of the URLs supported by Tomcat were exposed via httpd. A specially constructed request could also bypass the access controls configured in httpd in some configurations.

Recommendations

• Patch is available for mod_jk (version 1.2.46).

• Update to the latest version

Written by

Febna V M

Cyber Security Engineer

Febna once spent an entire evening arguing with an AI chatbot just to prove that machines can be confidently wrong. The debate ended with no clear winner, but it did spark her curiosity for the fascinating world of artificial intelligence. Today, she works at the intersection of AI and cybersecurity, helping build smarter systems while making sure they don’t become too smart for their own good. When she’s not exploring the future of technology, she’s probably asking “but what if?” one more time.