[SECURITY] CVE-2015-5174 Apache Tomcat Limited Directory Traversal

CVE-2015-5174 Apache Tomcat Limited Directory Traversal

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected:
- - Apache Tomcat 6.0.0 to 6.0.44
- - Apache Tomcat 7.0.0 to 7.0.64
- - Apache Tomcat 8.0.0.RC1 to 8.0.26
- - Apache Tomcat 9 is not affected
- - Earlier, unsupported Tomcat versions may be affected

Description:
When accessing resources via the ServletContext methods getResource()
getResourceAsStream() and getResourcePaths() the paths should be limited
to the current web application. The validation was not correct and paths
of the form "/.." were not rejected. Note that paths starting with
"/../" were correctly rejected.
This bug allowed malicious web applications running under a security
manager to obtain a directory listing for the directory in which the web
application had been deployed. This should not be possible when running
under a security manager. Typically, the directory listing that would be
exposed would be for $CATALINA_BASE/webapps.

Mitigation:
Users of affected versions should apply one of the following mitigations
- - Upgrade to Apache Tomcat 8.0.27 or later
- - Upgrade to Apache Tomcat 7.0.65 or later
- - Upgrade to Apache Tomcat 6.0.45 or later


Credit:
This issue was discovered by the Apache Tomcat security team.

References:
[1] http://tomcat.apache.org/security-9.html
[2] http://tomcat.apache.org/security-8.html
[3] http://tomcat.apache.org/security-7.html
[4] http://tomcat.apache.org/security-6.html