CVE-2018-11759: Apache mod_jk Access Control Bypass Vulnerability

by ·

Recently, Apache Tomcat officially released the mod_jk access control bypass vulnerability (CVE-2018-11759) security notice, the current PoC has been made public, please pay attention to relevant users, take timely preventive measures.

Apache Tomcat JK (mod_jk) Connector is a module that provides back-end Tomcat for Apache or IIS. It supports clustering and load balancing. This vulnerability (CVE-2018-11759) is similar to CVE-2018-1323 in that the Apache Tomcat web server (httpd) is used to specify the code for the request path, matching the URI-Worker mapping in the Apache Tomcat JK (mod_jk) connector. Previously, some edge cases (such as filtering “;”) were not handled correctly. An attacker could exploit this vulnerability to construct access control bypasses by constructing malicious requests.

Affected version:

  • Apache Tomcat JK mod_jk Connector 1.2.0 to 1.2.44

Unaffected version

  • Apache Tomcat JK mod_jk Connector 1.2.46

Solution

The Apache official has released a new version to fix the vulnerability. Please update the affected users to 1.2.46 or later to form a long-term effective protection against this vulnerability.

Users need to go to the official website to download the latest version of the source code to compile and install the latest version

Tags: