CVE-2018-11784 in Database Server
Summary
by MITRE
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/02/2026
This vulnerability in Apache Tomcat represents a critical security flaw that allows attackers to manipulate redirect responses through carefully crafted URLs. The issue manifests when the default servlet handles directory requests and generates redirects, creating an opportunity for path traversal and unauthorized access. The vulnerability affects multiple major versions of Tomcat including 9.0.0.M1 through 9.0.11, 8.5.0 through 8.5.33, and 7.0.23 through 7.0.90, indicating a widespread impact across the platform's lifecycle. The flaw specifically occurs when the servlet redirects to a directory path, enabling attackers to inject arbitrary URIs into the redirect response.
The technical mechanism behind this vulnerability involves the manipulation of URL handling within Tomcat's default servlet implementation. When a user requests a directory path that doesn't end with a forward slash, the servlet typically redirects to the same path with a trailing slash to ensure proper directory handling. However, the flaw allows attackers to craft URLs that bypass normal path resolution logic, enabling the redirect to point to any URI chosen by the attacker. This behavior stems from improper input validation and sanitization of the requested path before constructing redirect responses. The vulnerability falls under the CWE-601 vulnerability category, specifically CWE-601: URL Redirection to Untrusted Site ('Open Redirect'), which is classified as a high-risk security issue in the CWE database.
The operational impact of this vulnerability is significant as it can be exploited to perform various malicious activities including phishing attacks, credential theft, and unauthorized access to internal resources. Attackers can leverage this flaw to redirect users to malicious websites that appear to be legitimate Tomcat application pages, potentially capturing sensitive information. The vulnerability also enables path traversal attacks where attackers can manipulate the redirect target to access resources outside the intended application scope. This creates opportunities for information disclosure and privilege escalation within the affected systems. From an attacker's perspective, the vulnerability requires minimal technical expertise to exploit, making it particularly dangerous in production environments where Tomcat serves as a web application container.
Mitigation strategies for this vulnerability involve applying the official security patches released by Apache Tomcat for the affected versions. Organizations should immediately upgrade to patched versions of Tomcat, specifically versions 9.0.12, 8.5.34, and 7.0.91 or later. Additionally, administrators should implement proper URL validation at the application level and consider configuring web application firewalls to detect and block suspicious redirect patterns. Network-level protections can include monitoring for unusual redirect behavior and implementing strict access controls for directory access. The vulnerability also highlights the importance of input validation and proper sanitization of user-supplied data in web applications, aligning with ATT&CK technique T1071.004 for Application Layer Protocol: DNS. Organizations should also consider implementing security awareness training to help identify potential open redirect attacks and maintain regular security assessments to identify similar vulnerabilities in their web application infrastructure.