Questions tagged [tomcat]
The tomcat tag has no usage guidance.
51 questions
1
vote
1
answer
47
views
can a tomcat application sitting behind a reverse proxy be exploited
I am trying to exploit a vulnerability in tomcat based on CVE-2020-13935.
I found online this interesting poc https://blog.redteam-pentesting.de/2020/websocket-vulnerability-tomcat/
In my case, the ...
- 187
0
votes
0
answers
260
views
How to reproduce Tomcat 9.0.0.M1 HTTP smuggling vulnerabilities?
I'm trying to reproduce some of the Tomcat 9.x.x vulnerabilities from this list, in particular the HTTP smuggling vulnerabilities. However, so far I haven't been able to reproduce any of them. ...
1
vote
0
answers
2k
views
Disabling weak cipher suites in Tomcat does not work as expected
I have to get rid of so called "weak security" in a Tomcat application.
A penetration test identified services that accept connections with insecure TLS encryption and hashing algorithms: ...
- 161
0
votes
0
answers
317
views
cmd.jsp - Tomcat - Understanding HTTP Status Code (302)
I'm currently playing with cmd.jsp webshells on a Java webapp in tomcat.
This is the request (sending via burpsuite)
PUT /path/cmd.jsp HTTP/1.1
Host: 69.69.69.69
Content-Length: 579
<%@ page ...
1
vote
1
answer
268
views
spring4shell correction in tomcat
We use Tomcat, and version Tomcat 9.0.62 is supposed to fix the spring4shell vuln. To what extent is it the case? Are we safe not to upgrade to the latest Spring version?
- 11
1
vote
1
answer
398
views
Encryption with Tomcat & Nginx reverse proxy
I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind:
...
- 11
3
votes
0
answers
4k
views
Path normalization issue with semicolon in Tomcat
I have observed a path normalization issue in the tomcat when i was passing "..;" in the URL. I tested this out with Nginx and Apache-tomcat-10.0.0-M4. I was able to access file directories which are ...
- 31
1
vote
1
answer
4k
views
What measures can be taken to prevent Server Side Request Forgery (SSRF) in a JAX-RS Application running on Apache Tomcat?
If I have a an application server that uses an implementation of JAX-RS, and is running as *.war file on an Apache Tomcat server, is there anything special that needs to be done or configured to ...
- 326
0
votes
0
answers
910
views
Vulnerable Apache Tomcat server
I am a bug bounty hunter. When doing some research, I found a subdomain that is using Apache Tomcat. Talk about Tomcat, there was a vulnerability found in 2017: CVE-2017-12617.
Any Apache Tomcat ...
0
votes
1
answer
408
views
Security headers in application vs. Tomcat default 40x error
I would like to assess the actual risk for various CORS attacks when a web application properly sets CSP and other response headers, but the app server error page does not. When a 40x can be provoked ...
- 121
1
vote
2
answers
454
views
Does Apache Tomcat 9 meet PCI compliance?
Does Apache Tomcat 9 meet PCI compliance?
From where I should start reading and gather some information about that topic?
- 11
0
votes
1
answer
420
views
How apache tomcat favicon can be malicious or cause unintended results in application?
At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
- 101
3
votes
1
answer
506
views
Is Tomcat vulnerable to "Ghostcat" (CVE-2020-1938) via mod_proxy_ajp?
Is it possible to exploit the "Ghostcat" vulnerability (CNVD-2020-10487/CVE-2020-1938) indirectly over mod_proxy_ajp?
I was able to successfully test the proof-of-concept exploit (https://www....
- 797
2
votes
1
answer
709
views
Is Tomcat protecting against CSRF correctly?
If I read this correctly the way Tomcat protects against CSRF leaves it vulnerable to the situation where the CSRF token is duplicated in the cookie and request parameters which allows the attacker to ...
- 123
2
votes
1
answer
2k
views
Tomcat AJP vulnerability CVE-2020-1938 aka Ghostcat
I have a question about Tomcat vulnerability CVE-2020-1938 aka Ghostcat. The security researcher who discovered the vulnerability created a write up here: https://www.chaitin.cn/en/ghostcat and a PoC ...
- 123
3
votes
1
answer
860
views
Should I regenerate SSL certificates after upgrading Openssl
As you may already know old Openssl versions were vulnerable(OpenSSL 1.0.1 through 1.0.1f (inclusive)) by the HeartBleed vulnerability. Currently our server is running Tomcat7 which is built in a ...
- 153
1
vote
2
answers
2k
views
Using certificate on same server but different port for https
I have taken a working HTTPS certificate from a server that I want to use on the same server, just on a different port. The certificate has a Subject Alternative Name defined in it. Using keytool, I ...
- 11
-1
votes
1
answer
348
views
Java web app hosted in tomcat hanged for more than 10 min with logs containing powershell attack
We have a java web application running in tomcat which is hosted in AWS. The operating system used in the server is Centos. Today it become inaccessible for more than 10 minutes. When we got access, ...
- 1
1
vote
0
answers
581
views
includeSubDomains is not shown in https header after enabling hstsIncludeSubDomains in Tomcat
I enabled HSTS in the Tomcat web.xml like this:
<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>org.apache.catalina.filters....
- 11
3
votes
2
answers
1k
views
Security Benefits of Reverse Proxying Java / Tomcat WebApps Locally
Conventional wisdom seems to dictate that java applications should always be reverse proxied. It's what I have always done and so has everywhere I have worked at.
I have read multiple times that ...
- 273
3
votes
1
answer
4k
views
Does the CA have to be same for mutual authentication?
I'm trying to establish mutual authentication between my Tomcat server and my customer's firewall.
The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate).
The ...
1
vote
2
answers
11k
views
Tomcat application arbitrary file read exploitation
In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat.
In ...
- 11
3
votes
1
answer
3k
views
Exfiltration through FTP using XXE on a Tomcat server
I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents:
Base XML (...
- 269
-1
votes
1
answer
426
views
System Infected: Trojan.Naid Activity [closed]
We have Tomcat 6 in the production server with Symantec Endpoint Protection on windows server 2008 server datacenter.
Symantec showing following lines in logs
[SID: 27068] System Infected: Trojan....
- 397
1
vote
1
answer
661
views
Is this parameter vulnerable to SQL Injection?
The backend server is running Tomcat 8.5 (Java backend). The URL in question is:
https://website.com/application/servlet.do?currentOID=abc12300000000
I found that when I give an incomplete OID (i.e ...
- 269
1
vote
0
answers
123
views
Are java bean oids predictable?
For example, I'm facing bean names such as "<3 CHAR PREFIX>" ex. "FIL000000AZB3Y" (random name) where FIL refers to a File object, and the 0000... is the OID. Is it possible to predict this, or is ...
- 269
2
votes
1
answer
2k
views
JBoss Web vulnerabilities [duplicate]
In my organization I found servers running JBoss Web/7.0.13.Final and JBoss Web/7.0.12.Final.
I could not find security vulnerabilities for this server's versions, but they seem old to me.
How can I ...
- 495
1
vote
1
answer
507
views
What is the security risks of increasing the maximum number of HTTP parameter?
I want to increase the maximum number of HTTP parameters (maxParameterCount) from 10000 to 20000 in the Tomcat configuration:
https://tomcat.apache.org/tomcat-8.5-doc/config/http.html
What is the ...
- 1,479
1
vote
2
answers
8k
views
Host header injection attack with Spring boot embedded tomcat
Our application has been checked by PEN Test tool, and there are description of issue:
An attacker can redirect the application using the host header on the
below mentioned URL to redirect them ...
- 21
2
votes
1
answer
286
views
Why is CVE-2017-12617 considered a vulnerability?
CVE-2017-12617 is a remote code execution vulnerability via JSP upload. It requires the HTTP PUT method to be enabled on a vulnerable tomcat instance.
Why is this considered a vulnerability and CVE ...
- 151
0
votes
1
answer
753
views
Is TLS_ECDHE_RSA_WITH_RC4_128_SHA secure?
I was wondering whether TLS_ECDHE_RSA_WITH_RC4_128_SHA is secure.
We have added it within the ciphers tag of the Tomcat configuration file.
- 11
17
votes
5
answers
86k
views
Using the openssl command, how can I tell if it's using TLS 1.0?
Due to a security scan, I was told to not use TLS1.0. I found a link that gave me commands to use to check if a specific protocol is used/enabled. The command I ran (with output is)
(Output from TLS1....
- 273
1
vote
1
answer
756
views
Received weird request URL in my TOMCAT access logs
I have received some weird request URL in my TOMCAT access logs. which is as follows:-
\x16\x03\x01\x01\"\x01" 200 40788
as clearly seen from above log, the server has given 200(success) response to ...
- 397
1
vote
0
answers
7k
views
Only Enable TLSv1.2 on Tomcat 6.0.36
I need to make sure that a web app running on Tomcat 6.0.36 with Java 1.8 is only using TLS 1.2
As per documentation, I tried adjusting the Connector section in server.xml:
sslProtocol="TLSv1.2" (I ...
- 11
2
votes
0
answers
354
views
Encrypting File System Data at Rest on Windows Web Application
We have a web application (running in Apache Tomcat on a Windows Server 2008 machine) that stores most of its data in the file system. We are investigating ways to implement encryption for this data ...
- 141
1
vote
0
answers
79
views
TLS: Using different signature algorithms for ca and server certificate [duplicate]
I've the following scenario:
Root-CA: key algorithm is RSA-2048 and it's self-signed (Sha256WithRSA)
Server-Cert: key algorithm is ECDSA, based on secp384r1 and it's signed by Root-CA with ...
- 11
0
votes
1
answer
591
views
Access encrypted files (dm-crypt/LUKS) through web app
I'm a newbie to encryption issues and I'm trying to sort out a few questions.
For a distributed application we need to deploy a server outside of our company with sensitives PDF files on it. That ...
- 103
0
votes
1
answer
559
views
Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability
We have a Windows Server 2012 R2 running Apache 2.2.27 and Apache tomcat8 version 1.0.15.0.
Can you guys shed a few words on what the vulnerability is and also how to re-mediate this with the two ...
- 131
0
votes
1
answer
5k
views
Tomcat War Payload not working
So I am currently working my way through a few books. One of which had me download the metasploitable2 vm. This machine has a tomcat server running on it which I successfully exploited using ...
- 1,471
2
votes
1
answer
1k
views
Sanitize 3rd party XSS post in Java API
We have some RESTful API services that we have been using for several years. Recently we have started considering surfacing these to 3rd party clients so they can write their own UIs and we can work ...
- 21
-1
votes
1
answer
939
views
How to choose ECDH and ECDHE with curve more than 192 in Tomcat
I am using tomcat server, where I came across a situation where the TestSSLServer tool reports the below.
Highly appreciate your expertise in recommending a solution to the finding where I can choose ...
- 1
0
votes
1
answer
4k
views
Is Tomcat session ID generation FIPS compliant?
I am trying to achieve the following security rule
server must generate a unique session identifier using a FIPS 140-2 approved random number generator.
I am using Tomcat 7.0.68 for my server, I am ...
- 103
0
votes
2
answers
1k
views
SSL certificate for server authentication
to clear my understandings:
I create self signed certificate first
keytool -genkey -alias mysign -keyalg RSA -keystore mykeystorename.jks
the firstname of the self sign has to be my domain name?
...
1
vote
1
answer
198
views
What are the implication of having Apache Tomcat servlets available publicly?
While testing a website which had Apache Tomcat running, I came across a directory called "Examples" which contained "Servlet Examples", "JSP Examples" and "Websocket Examples".
What do you think are ...
- 397
0
votes
1
answer
212
views
Is it a breach to have a ssh program into a tomcat server
I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask.
It is a Java Web project that was made to run into a Tomcat ...
- 103
5
votes
1
answer
2k
views
Does TrustManager PKIX (or RFC 3280/X.509) really check the expiration date of a client's certificate?
It was noticed that the default java implementation of TrustManagerFactory for PKIX trust manager algorithm (X509ExtendedTrustManager) doesn't really check the expiration date of a client's ...
- 153
1
vote
3
answers
1k
views
Is it necessary to update JRE in an Apache Tomcat Server?
We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42.
Users have expressed their concerns about Java 7's support/updates being ...
- 111
1
vote
2
answers
4k
views
What algorithm should I use to avoid the error "ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY"?
I got a CA cert by submitting my CSR from GoDaddy, after applying a certificate to my Tomcat web server. When I access my website using Chrome or Mozilla I face the error:
...
- 11
3
votes
1
answer
12k
views
Creating an TLS certificate using keytool with SHA-256
I want to create a TLS certificate for my personal tomcat8 webserver on a Debian ARM server. I've done this before, using the following command:
/usr/bin/keytool -genkey -alias tomcat -keyalg RSA -...
- 7,569
9
votes
3
answers
5k
views
Does the recommended course of action for preventing Logjam on Tomcat servers really eliminate all risks of weak DH keys?
Can anyone verify this fix secures against the Logjam vulnerability for Apache Tomcat?
I'm sceptical about it's effectiveness, since it doesn't mention how to implement the user defined 2048 bit DH ...
- 193