CVE-2007-1358 in Tomcat
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2019
The vulnerability described in CVE-2007-1358 represents a critical cross-site scripting flaw affecting Apache Tomcat versions ranging from 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34. This weakness stems from insufficient input validation within the application's handling of HTTP Accept-Language headers, creating an avenue for remote attackers to execute malicious web scripts or HTML code within the context of vulnerable applications. The flaw specifically manifests when applications process language headers that do not adhere to the standards outlined in RFC 2616, which governs HTTP protocol implementations. The vulnerability operates at the application layer and demonstrates a classic XSS attack vector where attacker-controlled input is improperly sanitized before being rendered in web responses.
The technical implementation of this vulnerability exploits the way Tomcat's request processing pipeline handles malformed Accept-Language headers. When these headers contain characters or sequences that deviate from RFC 2616 specifications, the server fails to properly escape or validate the input before incorporating it into HTTP responses. This processing error creates an environment where malicious payloads can be injected and subsequently executed by unsuspecting users who interact with the affected web application. The vulnerability's classification aligns with CWE-79, which specifically addresses cross-site scripting flaws in software applications. The attack requires minimal prerequisites as it leverages standard HTTP header manipulation techniques that are commonly used in web application reconnaissance and exploitation phases.
From an operational perspective, this vulnerability presents significant risk to organizations running affected Tomcat versions as it allows attackers to perform session hijacking, deface web applications, steal sensitive user data, or redirect users to malicious websites. The remote nature of the attack means that exploitation can occur from any location without requiring physical access to the target system. The impact extends beyond simple data theft to include potential privilege escalation scenarios where attackers could manipulate application behavior or access restricted resources. This vulnerability particularly affects legacy systems that have not been updated to newer Tomcat versions, as the flaw was addressed in subsequent releases through improved input validation mechanisms. Security professionals should note that this vulnerability aligns with ATT&CK technique T1566.001, which covers spearphishing attachments, as attackers could leverage this flaw to deliver malicious payloads through crafted web requests.
Organizations should implement immediate mitigations including updating to patched versions of Apache Tomcat, typically those beyond 4.1.34 for the 4.1.x series and 4.0.7 for the 4.0.x series. Additionally, implementing proper input validation and output encoding mechanisms can provide defense-in-depth measures. Web application firewalls should be configured to monitor and filter malformed Accept-Language headers, while security teams should conduct comprehensive vulnerability assessments to identify all instances of affected Tomcat installations. The remediation process should also include thorough code reviews of applications that might be processing user-supplied headers, ensuring that proper sanitization techniques are implemented according to OWASP secure coding guidelines. Regular patch management procedures should be enforced to prevent similar vulnerabilities from being introduced through outdated software components.