CVE-2007-0450: Path Traversal

Directory traversal vulnerability in Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (modproxy, modrewrite, modjk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) / (slash), (2) \ (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

From http://tomcat.apache.org/security-5.html

Fixed in Apache Tomcat 5.5.22, 5.0.HEAD

Directory traversal CVE-2007-0450

Tomcat permits '\', '%2F' and '%5C' as path delimiters. When Tomcat is used behind a proxy (including, but not limited to, Apache HTTP server with modproxy and modjk) configured to only proxy some contexts, a HTTP request containing strings like "/\../" may allow attackers to work around the context restriction of the proxy, and access the non-proxied contexts.

The following Java system properties have been added to Tomcat to provide additional control of the handling of path delimiters in URLs (both options default to false):

org.apache.tomcat.util.buf.UDecoder.ALLOWENCODEDSLASH: true|false org.apache.catalina.connector.CoyoteAdapter.ALLOWBACKSLASH: true|false

Due to the impossibility to guarantee that all URLs are handled by Tomcat as they are in proxy servers, Tomcat should always be secured as if no proxy restricting context access was used.

Affects: 5.5.0-5.5.21, 5.0.0-5.0.30

— Red Hat