Apache Tomcat Server-Side Request Forgery (SSRF) Vulnerability
A Server-Side Request Forgery (SSRF) vulnerability in Apache Tomcat versions 10.1.0 through 10.1.15 and 9.0.0 through 9.0.82 allows remote attackers to make arbitrary HTTP requests from the server via specially crafted requests to the AJP connector.
This section explains the vulnerability in everyday language, so anyone can understand the risk and impact.
Apache Tomcat, a popular web server software, has a security flaw that could let attackers trick the server into making unwanted web requests to other systems. This is like someone using the server as a puppet to access other computers or internal networks that should be private.
The problem affects many versions of Tomcat and could be used by attackers to gather information about internal systems, access restricted resources, or potentially attack other servers from the compromised Tomcat server. This is particularly dangerous because the requests would appear to come from the trusted Tomcat server rather than the actual attacker.
Affected Products
Remediation
1. Upgrade Apache Tomcat to version 9.0.83 or 10.1.16 or later
2. If immediate upgrade is not possible, disable the AJP connector if not required
3. If AJP connector is required, implement network-level controls to restrict access to the AJP port (8009)
4. Configure requiredSecret attribute on the AJP Connector to prevent unauthorized access