Executive Summary

This vulnerability is an Improper Input Validation issue in Apache Tomcat where the server did not properly limit HTTP/0.9 requests to only the GET method.

Specifically, if a security constraint was set to allow HEAD requests to a URI but deny GET requests, an attacker could bypass this restriction by sending a HEAD request using the HTTP/0.9 protocol, which is invalid according to specifications.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to bypass security constraints that are intended to restrict GET requests by exploiting the handling of HTTP/0.9 HEAD requests.

As a result, unauthorized access to resources that should be protected from GET requests could occur, potentially exposing sensitive information or functionality.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Apache Tomcat improperly handling HTTP/0.9 requests, allowing bypass of security constraints by sending a HEAD request using HTTP/0.9.

To detect this vulnerability on your system or network, you can attempt to send HTTP/0.9 HEAD requests to your Tomcat server and observe if security constraints are bypassed.

Since HTTP/0.9 is an obsolete protocol, many common tools do not support it directly. However, you can use low-level tools like netcat (nc) or telnet to manually craft such requests.

• Use netcat to send a raw HTTP/0.9 HEAD request: echo -e "HEAD /path HTTP/0.9\r\n" | nc your-tomcat-server 80
• Use telnet to connect to the server and manually type the HTTP/0.9 HEAD request: telnet your-tomcat-server 80, then type: HEAD /path HTTP/0.9

If the server responds to these requests and bypasses configured security constraints (e.g., allows access where GET is denied), the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation is to upgrade Apache Tomcat to a fixed version.

• Upgrade to Apache Tomcat version 11.0.15 or later.
• Or upgrade to version 10.1.50 or later.
• Or upgrade to version 9.0.113 or later.

These versions contain the fix that properly limits HTTP/0.9 requests and prevents bypassing security constraints.

Useful 0 Not Useful 0