CVE-2014-0095 in Tomcat
Summary
by MITRE
java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 06/20/2021
The vulnerability described in CVE-2014-0095 represents a critical denial of service weakness in Apache Tomcat versions 8.x prior to 8.0.4 that specifically targets the AJP protocol implementation within the web server. This flaw exists in the AbstractAjpProcessor.java file which handles AJP (Apache JServ Protocol) requests, a communication protocol commonly used between web servers and application servers. The vulnerability manifests when a remote attacker crafts a malicious AJP request containing a "Content-Length: 0" header, which triggers an abnormal processing state in the Tomcat server's request handling mechanism.
The technical exploitation of this vulnerability occurs through the improper handling of AJP requests that contain a zero-length content header. When Tomcat processes such requests, the server enters an indefinite waiting state during request processing, effectively consuming threads that should remain available for legitimate requests. This thread consumption behavior creates a resource exhaustion scenario where the server gradually becomes unable to handle new incoming requests, leading to complete service unavailability. The flaw stems from inadequate validation and handling of the Content-Length header within the AJP protocol processing pipeline, allowing malformed requests to bypass normal processing flow and enter a deadlock condition.
The operational impact of CVE-2014-0095 is severe and directly affects the availability of web applications hosted on affected Tomcat servers. Attackers can exploit this vulnerability with minimal resources to cause significant disruption to business operations, potentially leading to complete service outages that affect customer access and business continuity. The vulnerability is particularly dangerous because it can be exploited remotely without authentication requirements, making it accessible to any attacker with network access to the affected server. This weakness is classified under CWE-400 as "Uncontrolled Resource Consumption" and aligns with ATT&CK technique T1499.004 for "Endpoint Denial of Service" which specifically addresses resource exhaustion attacks targeting server availability.
Organizations affected by this vulnerability should immediately implement mitigations including upgrading to Apache Tomcat 8.0.4 or later versions where the issue has been resolved through proper handling of the Content-Length header in AJP requests. Network-level mitigations such as implementing firewall rules to restrict AJP protocol access to trusted sources can provide temporary protection while upgrades are being deployed. Additionally, monitoring for unusual thread consumption patterns and implementing automated alerting for high thread usage can help detect exploitation attempts. The fix implemented in the patched versions addresses the root cause by ensuring proper validation of AJP request headers and preventing the thread hanging condition that previously occurred when processing requests with zero-length content headers.