XSS in examples web application

Vulnerability

Description

CVE-2022-34305 is a reflected cross-site scripting (XSS) vulnerability in the Apache Tomcat examples web application, specifically in the form authentication example. The application displays user-provided data without proper filtering or encoding, allowing an attacker to inject arbitrary HTML or JavaScript into the response [1]. This affects Tomcat versions 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64, and 8.5.50 to 8.5.81 [2].

Exploitation

The examples web application is not enabled by default in production deployments, but it is included in the default distribution. If enabled, an attacker can craft a malicious URL that, when visited by a victim, executes the injected script in the context of the Tomcat domain. No authentication is required to access the vulnerable endpoint, and the attack can be performed remotely over HTTP [2].

Impact

Successful exploitation allows an attacker to perform actions on behalf of the victim, such as stealing session cookies, redirecting to phishing sites, or defacing the web page. The severity is rated as low by the Apache Tomcat security team, but the impact depends on the context of the application and the privileges of the victim [2].

Mitigation

Apache has released fixed versions: 10.1.0-M17, 10.0.23, 9.0.65, and 8.5.82. Users are advised to upgrade to these versions or, as a workaround, remove the examples web application from the deployment [1][2]. Gentoo Linux also provides updated packages in its GLSA 202208-34 advisory [3].