https://bz.apache.org/bugzilla/show_bug.cgi?id=70208
Bug ID: 70208
Summary: Incorrect isSameWebApplication result may introduce
unintended URL encode behavior - session id part
Product: Tomcat 11
Version: 11.0.25
Hardware: PC
OS: Mac OS X 10.1
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: -------
Assumption: Cross-Context session false, session tracking with url rewriting,
current context path is "/admin".
1. response.encodeURL("/admin/foo"): isSameWebApplication TRUE, encoded it -
append current session id in URL, as expected.
2. response.encodeURL("/admin/../public/foo"): isSameWebApplication - Expected:
False, Actual: True, -> "/admin/../public/foo;jsessionid=<USER_SESSION>"
3.
response.encodeURL("/public/../admin/foo;jsessionid=INJECTED_ADMIN_SESSION"):
isSameWebApplication - Expected: True, Actual: False, ->
"/public/../admin/foo;jsessionid=INJECTED_ADMIN_SESSION" UNCHANGED.
If the uri is controlled by attacker (article author or media poster) and
unsanitized, the recommended encodedURL/encodeRedirectURL may allow unexpected
session leakage or fixation.
Strip Path Param and normalize before context-path matching.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
