中危 Apache Tomcat up to 7.0.93/8.5.39/9.0.0.17 SSI printenv Command 跨站脚本攻击

CVE编号

CVE-2019-0221

利用情况

POC 已公开

补丁情况

官方补丁

披露时间

2019-05-29
漏洞描述
Apache Tomcat 9.0.0.M1到9.0.0.17,8.5.0到8.5.39和7.0.0到7.0.93中的SSI printenv命令回应用户提供的数据而不会转义,因此容易受到XSS的攻击。默认情况下禁用SSI。 printenv命令用于调试,不太可能出现在生产网站中。<br>
解决建议
建议您更新当前系统或软件至最新版,完成漏洞的修复。
参考链接
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html
http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site...
http://seclists.org/fulldisclosure/2019/May/50
http://www.securityfocus.com/bid/108545
https://access.redhat.com/errata/RHSA-2019:3929
https://access.redhat.com/errata/RHSA-2019:3931
https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f55...
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fff...
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5...
https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f67...
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2...
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a148...
https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab...
https://lists.debian.org/debian-lts-announce/2019/05/msg00044.html
https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...
https://seclists.org/bugtraq/2019/Dec/43
https://security.gentoo.org/glsa/202003-43
https://security.netapp.com/advisory/ntap-20190606-0001/
https://support.f5.com/csp/article/K13184144?utm_source=f5support&amp;utm_medium=RSS
https://usn.ubuntu.com/4128-1/
https://usn.ubuntu.com/4128-2/
https://www.debian.org/security/2019/dsa-4596
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-comma...
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 apache tomcat * From
(including)
7.0.0
Up to
(including)
7.0.93
运行在以下环境
应用 apache tomcat * From
(including)
8.5.0
Up to
(including)
8.5.39
运行在以下环境
应用 apache tomcat * From
(including)
9.0.1
Up to
(including)
9.0.17
运行在以下环境
应用 apache tomcat 9.0.0 -
运行在以下环境
系统 amazon linux_AMI tomcat8 * Up to
(excluding)
8.5.42-1.80.amzn1
运行在以下环境
系统 amazon_AMI tomcat8 * Up to
(excluding)
8.5.42-1.80.amzn1
运行在以下环境
系统 debian_8 tomcat8 * Up to
(excluding)
7.0.56-3+deb8u3
运行在以下环境
系统 debian_9 tomcat8 * Up to
(including)
7.0.75-1
运行在以下环境
系统 fedora_29 tomcat8 * Up to
(excluding)
9.0.21-1.fc29
运行在以下环境
系统 fedora_30 tomcat8 * Up to
(excluding)
9.0.21-1.fc30
运行在以下环境
系统 fedora_EPEL_6 tomcat8 * Up to
(excluding)
7.0.94-1.el6
运行在以下环境
系统 opensuse_Leap_15.0 tomcat8 * Up to
(excluding)
9.0.20-lp150.2.19.1
运行在以下环境
系统 opensuse_Leap_15.1 tomcat8 * Up to
(excluding)
9.0.21-lp151.3.3.1
运行在以下环境
系统 sles_12 tomcat * Up to
(excluding)
9.0.21-3.13
运行在以下环境
系统 sles_12_SP4 tomcat8 * Up to
(excluding)
9.0.21-3.13.2
运行在以下环境
系统 suse_12 tomcat * Up to
(excluding)
9.0.21-3.13
运行在以下环境
系统 suse_12_SP4 tomcat8 * Up to
(excluding)
9.0.21-3.13.2
运行在以下环境
系统 ubuntu_16.04 tomcat8 * Up to
(excluding)
8.0.32-1ubuntu1.10
运行在以下环境
系统 ubuntu_16.04.7_lts tomcat8 * Up to
(excluding)
8.0.32-1ubuntu1.10
运行在以下环境
系统 ubuntu_16.04_lts tomcat8 * Up to
(excluding)
8.0.32-1ubuntu1.10
运行在以下环境
系统 ubuntu_18.04 tomcat8 * Up to
(excluding)
9.0.16-3ubuntu0.18.04.1
运行在以下环境
系统 ubuntu_18.04.5_lts tomcat8 * Up to
(excluding)
8.5.39-1ubuntu1~18.04.3
运行在以下环境
系统 ubuntu_18.04_lts tomcat8 * Up to
(excluding)
8.5.39-1ubuntu1~18.04.3
阿里云评分
4.6
  • 攻击路径
    远程
  • 攻击复杂度
    容易
  • 权限要求
    无需权限
  • 影响范围
    有限影响
  • EXP成熟度
    POC 已公开
  • 补丁情况
    官方补丁
  • 数据保密性
    数据泄露
  • 数据完整性
    传输被破坏
  • 服务器危害
    无影响
  • 全网数量
    N/A
CWE-ID 漏洞类型
CWE-79 在Web页面生成时对输入的转义处理不恰当(跨站脚本)
阿里云安全产品覆盖情况