CVE-2002-1567 in Tomcat
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/13/2025
The vulnerability identified as CVE-2002-1567 represents a critical cross-site scripting flaw within Apache Tomcat version 4.1 that enables remote attackers to execute malicious web scripts and potentially steal user session cookies. This vulnerability exploits the way Tomcat processes URL-encoded data, specifically when encoded newlines are present in the URL path. The flaw occurs during the parsing of requests where the web server fails to properly sanitize input containing encoded newline characters, creating an opening for attackers to inject malicious JavaScript code. The attack vector requires a specific sequence where the attacker crafts a URL with encoded newlines followed by a request to a .jsp file that contains the malicious script, leveraging the server's insufficient input validation mechanisms.
The technical implementation of this vulnerability stems from improper handling of URL decoding and input sanitization within the Tomcat servlet container. When the server encounters a URL containing encoded newline characters, the parsing process does not adequately filter or escape these characters before processing the request. This allows attackers to inject JavaScript code that gets executed in the context of the victim's browser when they access the maliciously crafted URL. The vulnerability is particularly dangerous because it operates at the application layer, targeting the web server's request processing logic rather than underlying infrastructure components. The specific requirement for a .jsp file name containing the script indicates that the flaw affects the server's handling of dynamic content generation and request routing.
The operational impact of this vulnerability extends beyond simple script execution to include session hijacking and user data theft. Attackers can craft URLs that, when visited by unsuspecting users, execute malicious scripts that steal session cookies, potentially gaining unauthorized access to user accounts and sensitive information. The vulnerability affects the integrity of the web application's security model by allowing attackers to bypass standard input validation mechanisms that should prevent such malicious code execution. This creates a significant risk for web applications hosted on vulnerable Tomcat servers, particularly those handling user authentication, personal information, or sensitive transactions. The attack can be executed remotely without requiring any special privileges or access to the server itself, making it a particularly concerning security flaw for organizations relying on the affected Tomcat version.
Organizations should implement multiple layers of mitigation strategies to address this vulnerability effectively. Immediate patching of the Tomcat server to a version that properly handles URL decoding and input sanitization remains the primary recommendation. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and can be mapped to ATT&CK technique T1059.007 for script execution through web applications. Additional mitigations include implementing proper input validation and sanitization at the application level, configuring web application firewalls to detect and block suspicious URL patterns containing encoded characters, and deploying content security policies to limit script execution. Regular security auditing of web applications and input validation mechanisms should be conducted to identify similar vulnerabilities, while network monitoring should be enhanced to detect anomalous request patterns that may indicate exploitation attempts. The vulnerability demonstrates the critical importance of proper input handling in web server implementations and serves as a reminder of the need for comprehensive security testing throughout the software development lifecycle.