CVE-2023-41080

MEDIUM

Apache Tomcat: Open redirect with FORM authentication

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-41080 has a selected CVSS score of 6.1 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 27, 2024 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

Apache Tomcat

Browse Apache Software Foundation / Apache Tomcat

Default status: unaffected

CVE List11.0.0-M1 to ≤ 11.0.0-M10affected
10.1.0-M1 to ≤ 10.0.12affected
9.0.0-M1 to ≤ 9.0.79affected
8.5.0 to ≤ 8.5.92affected
3 to < 8.5.0unknown
10.0.0-M1 to ≤ 10.0.27unknown

org.apache.tomcat.embed:tomcat-embed-core

Browse Maven / org.apache.tomcat.embed:tomcat-embed-core
GitHub Advisory8.5.0 to < 8.5.93 · Fixed in 8.5.93affected
9.0.0-M1 to < 9.0.80 · Fixed in 9.0.80affected
10.1.0-M1 to < 10.1.13 · Fixed in 10.1.13affected
11.0.0-M1 to < 11.0.0-M11 · Fixed in 11.0.0-M11affected

org.apache.tomcat:tomcat

Browse Maven / org.apache.tomcat:tomcat
GitHub Advisory11.0.0-M1 to < 11.0.0-M11 · Fixed in 11.0.0-M11affected
10.1.0-M1 to < 10.1.13 · Fixed in 10.1.13affected
9.0.0-M1 to < 9.0.80 · Fixed in 9.0.80affected
8.5.0 to < 8.5.93 · Fixed in 8.5.93affected

org.apache.tomcat:tomcat-catalina

Browse Maven / org.apache.tomcat:tomcat-catalina
GitHub Advisory8.5.0 to < 8.5.93 · Fixed in 8.5.93affected
10.1.0-M1 to < 10.1.13 · Fixed in 10.1.13affected
9.0.0-M1 to < 9.0.80 · Fixed in 9.0.80affected

Proofs of concept

1

Repository PoCs

GitHubshiomiyan/CVE-2023-41080Repository PoCby shiomiyan11Not analyzed7 files

173.2 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

compose.yml

shiomiyan/CVE-2023-41080Created Vuln labCVE-2023-41080Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that runs two Apache Tomcat containers (versions 9.0.79 and 9.0.80) with a custom web application and configuration files mounted from the host. The README indicates it is a demonstration of CVE-2023-41080, a URL parsing vulnerability in Tomcat.

compose.yml:1-20README.md:1-5

Lab assessment

Vulnerability lab

The environment is explicitly named after CVE-2023-41080, includes two Tomcat versions (vulnerable 9.0.79 and patched 9.0.80), and the README provides example URLs to demonstrate the vulnerability and the fix. This is a typical setup for a vulnerability reproduction lab.

compose.yml:1README.md:1-5
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

tomcat-9-0-79

vulnerable target

Tomcat 9.0.79 container serving a web application with FORM-based authentication. It is the vulnerable version for CVE-2023-41080. Exposes port 8081 on the host.

compose.yml:4-10README.md:1

tomcat-9-0-80

patched reference

Tomcat 9.0.80 container with the same configuration as the vulnerable version. It is the patched version for CVE-2023-41080. Exposes port 8082 on the host.

compose.yml:12-18README.md:3

web application (ROOT)

target web application

A simple web application with a login page (login.html), a protected resource (secret.html), and an error page (error.html). It uses FORM-based authentication with the role 'admin'.

webapps/ROOT/login.html:1-16webapps/ROOT/secret.html:1webapps/ROOT/error.html:1conf/web.xml:22-40

tomcat-users.xml

authentication configuration

Defines a user 'admin' with password 'admin' and role 'admin', used for the web application's authentication.

conf/tomcat-users.xml:56-57

web.xml

web application deployment descriptor

Standard Tomcat web.xml with added security constraints for the /secret.html resource, requiring the 'admin' role and using FORM-based authentication.

conf/web.xml:22-40
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-41080

Supported by supplied evidence

The README explicitly links the environment to CVE-2023-41080, provides example URLs demonstrating the vulnerability on the vulnerable version and the fix on the patched version, and references a GitHub advisory (GHSA-q3mw-pvr8-9ggc) which corresponds to this CVE.

README.md:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.compose.yml:1-20
  • The host must have the necessary files (compose.yml, conf/, webapps/) in the current directory.compose.yml:7-9

Evidence-described exercise path

  1. Start the environment with 'docker-compose up'.compose.yml:1-20
  2. Access the vulnerable Tomcat instance at http://localhost:8081//secret.html;@example.com to observe the redirect to an arbitrary site (https://example.com).README.md:1-2
  3. Access the patched Tomcat instance at http://localhost:8082//secret.html;@example.com to verify the vulnerability is fixed.README.md:3
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. It only exposes ports 8081 and 8082 on the host for local testing. There are no privileged mode, host network, or other escape mechanisms. The mounted files are standard configuration and a simple web application. No hidden or destructive behavior is visible.

compose.yml:1-20
Review boundaries

What the analysis did not establish

  • The packet does not include the actual exploit code or a detailed description of the vulnerability mechanism beyond the README examples.
  • The webapps/ROOT directory may contain additional files not included in the evidence, but only the listed files are visible.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

11