Critical · published May 16, 2018
⚠️ The CORS filter in certain versions of Apache Tomcat has a configuration that could leave your applications vulnerable like a restaurant that lets anyone into the kitchen without checking credentials! 🚪🔑 Picture a restaurant where every customer can walk into the kitchen and grab whatever they want. That's what happens if the CORS filter’s default setting allows 'supportsCredentials' for all origins – it lets any site access sensitive data, just like a waiter letting anyone waltz into the chef's domain without a check! If misconfigured, this can lead to unauthorized access to sensitive user data, which could be absolutely devastating for your application and its users. An attacker could exploit this to hijack sessions or steal information intended for authenticated users. Yikes!
Picture a restaurant where every customer can walk into the kitchen and grab whatever they want. That's what happens if the CORS filter’s default setting allows 'supportsCredentials' for all origins – it lets any site access sensitive data, just like a waiter letting anyone waltz into the chef's domain without a check! Insecure default settings for the CORS filter in Apache Tomcat versions 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.41 to 7.0.88 allow 'supportsCredentials' for all origins, creating a potential security risk if not configured properly by users.
If misconfigured, this can lead to unauthorized access to sensitive user data, which could be absolutely devastating for your application and its users. An attacker could exploit this to hijack sessions or steal information intended for authenticated users. Yikes! To secure your application, review your Tomcat CORS filter configuration and disable 'supportsCredentials' if it's set to allow all origins. Ensure you have a strict allowlist of trusted origins configured. It's time to tighten those security bolts! You've got this! With a quick configuration review, you can turn this potential pitfall into a secure fortress. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | ≥ 7.0.41, ≤ 7.0.88 | — |
| apache/tomcat | ≥ 8.0.0, ≤ 8.0.52 | — |
| apache/tomcat | ≥ 8.5.0, ≤ 8.5.31 | — |
| apache/tomcat | ≥ 9.0.0, ≤ 9.0.8 | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/oncommand_unified_manager | ≥ 9.4 | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/snapcenter_server | all versions | — |
| netapp/storage_automation_store | all versions | — |
| netapp/oncommand_unified_manager | ≥ 7.3 | — |