Critical · published October 27, 2025
🔥 A crafty URL is all it takes to inject ANSI escape sequences in Apache Tomcat's log messages! Think of this like a waiter who brings you a menu but also hands you a pen to write in secret orders, allowing someone to trick you into placing a hidden request. If the console is vulnerable, they could manipulate the commands you run as if they were taking your order! An attacker could potentially manipulate your console and clipboard, creating a pathway to execute commands without your knowledge! This could lead to devastating consequences, like unauthorized access to sensitive configurations or even a full system breach. The risk is absolutely critical!
Think of this like a waiter who brings you a menu but also hands you a pen to write in secret orders, allowing someone to trick you into placing a hidden request. If the console is vulnerable, they could manipulate the commands you run as if they were taking your order! This vulnerability arises from Tomcat's failure to properly neutralize ANSI escape sequences in log messages, allowing attackers to inject these sequences to manipulate the console in a Windows environment.
An attacker could potentially manipulate your console and clipboard, creating a pathway to execute commands without your knowledge! This could lead to devastating consequences, like unauthorized access to sensitive configurations or even a full system breach. The risk is absolutely critical! Upgrade Apache Tomcat immediately to version 11.0.11, 10.1.45, or 9.0.109 and review your logging configurations. This will ensure that those pesky ANSI sequences can’t slip through the cracks! You've got this! With a swift update, you'll have your defenses back up in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | ≥ 10.0.0, < 10.0.27 | 10.0.27 |
| apache/tomcat | ≥ 10.1.0, < 10.1.45 | 10.1.45 |
| apache/tomcat | ≥ 11.0.0, < 11.0.11 | 11.0.11 |
| apache/tomcat | ≥ 8.5.60, ≤ 8.5.100 | — |
| apache/tomcat | ≥ 9.0.40, < 9.0.109 | 9.0.109 |