Apache Tomcat Relative Path Traversal Vulnerability with Potential Remote Code Execution

A relative path traversal vulnerability has been identified in Apache Tomcat versions 11.0.0-M1 prior to 11.0.10, 10.1.0-M1 prior to 10.1.44, and 9.0.0.M11 prior to 9.0.108. This vulnerability arises from a regression introduced by the fix for bug 60013, which normalized rewritten URLs before decoding them. As a result, an attacker could manipulate the request URI to bypass security constraints, particularly those protecting the /WEB-INF/ and /META-INF/ directories. If PUT requests were enabled, this could lead to the upload of malicious files and remote code execution, although it is generally unlikely for PUT requests to be allowed alongside such a URI-manipulating rewrite.

Impact

Exploitation of this vulnerability could result in unauthorized access to restricted directories and, if PUT requests are enabled, allow for remote code execution by uploading malicious files.

Remediation

Users are advised to upgrade to Apache Tomcat 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later.