CVE-2022-34305: Apache Tomcat XSS Vulnerability

CVE-2022-34305 Overview

CVE-2022-34305 is a Cross-Site Scripting (XSS) vulnerability affecting Apache Tomcat's examples web application. The Form authentication example in the examples web application displays user-provided data without proper filtering or sanitization, allowing attackers to inject malicious scripts that execute in the context of other users' browsers.

Critical Impact

Attackers can exploit this XSS vulnerability to steal session cookies, hijack user sessions, perform actions on behalf of authenticated users, or redirect victims to malicious websites through the vulnerable Form authentication example page.

Affected Products

• Apache Tomcat 10.1.0-M1 to 10.1.0-M16
• Apache Tomcat 10.0.0-M1 to 10.0.22
• Apache Tomcat 9.0.30 to 9.0.64
• Apache Tomcat 8.5.50 to 8.5.81

Discovery Timeline

• 2022-06-23 - CVE-2022-34305 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-34305

Vulnerability Analysis

This Cross-Site Scripting vulnerability exists within the Form authentication example bundled with Apache Tomcat's examples web application. The root issue stems from the application's failure to properly sanitize or encode user-supplied input before rendering it back to the browser. When user-provided data is reflected in the HTML response without appropriate output encoding, it creates an opportunity for script injection attacks.

The vulnerability requires user interaction to exploit, as victims must be tricked into visiting a crafted URL or submitting a malicious form. Once triggered, the injected script executes within the security context of the vulnerable Tomcat application, potentially allowing session theft, credential harvesting, or other client-side attacks. The scope is changed, meaning the vulnerability can impact resources beyond its original security scope.

Root Cause

The Form authentication example in Tomcat's examples web application fails to implement proper output encoding for user-provided data. This is a classic reflected XSS pattern (CWE-79) where input from HTTP request parameters or form fields is directly embedded into the HTML response without sanitization. The lack of context-appropriate encoding (HTML entity encoding, JavaScript encoding, etc.) allows attackers to break out of the expected data context and inject executable script content.

Attack Vector

The attack vector is network-based, requiring no authentication or special privileges to exploit. An attacker crafts a malicious URL containing XSS payload targeting the Form authentication example page. The attacker then distributes this URL through phishing emails, social engineering, or by embedding it in other websites. When a victim clicks the link or is redirected to the malicious URL, the Tomcat server reflects the payload without sanitization, causing the victim's browser to execute the attacker's JavaScript code.

The exploitation flow typically involves injecting script tags or event handlers into URL parameters that are subsequently displayed on the authentication example page. The payload executes with the same origin as the Tomcat application, giving it access to cookies, session storage, and the ability to make authenticated requests.

Detection Methods for CVE-2022-34305

Indicators of Compromise

• Unusual URL patterns in web server logs containing script tags, event handlers (e.g., onerror, onload), or JavaScript protocol handlers targeting the examples web application
• HTTP requests to /examples/jsp/security/protected/ or related Form authentication example paths with encoded or obfuscated script payloads
• Client-side error logs showing unexpected JavaScript execution or cross-origin requests originating from Tomcat pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS patterns in requests to the Tomcat examples application
• Monitor web server access logs for requests containing characteristic XSS payload signatures such as <script>, javascript:, or encoded variants targeting example applications
• Deploy browser-based security headers (Content-Security-Policy) and monitor for policy violations that may indicate XSS attempts

Monitoring Recommendations

• Enable detailed access logging for the Tomcat examples web application and configure log analysis to flag suspicious request patterns
• Set up alerts for unusual traffic patterns to the /examples/ directory, particularly the Form authentication example paths
• Monitor for reports of session hijacking or unauthorized actions that could indicate successful XSS exploitation

How to Mitigate CVE-2022-34305

Immediate Actions Required

• Upgrade Apache Tomcat to a patched version: 10.1.0-M17 or later for the 10.1.x branch, 10.0.23 or later for the 10.0.x branch, 9.0.65 or later for the 9.0.x branch, or 8.5.82 or later for the 8.5.x branch
• Remove or disable the examples web application from production Tomcat deployments if not required for operations
• Implement Content-Security-Policy headers to mitigate the impact of any XSS vulnerabilities

Patch Information

Apache has addressed this vulnerability in subsequent releases. Organizations should upgrade to the fixed versions as documented in the Apache Thread Discussion. Additional security advisories are available from Gentoo GLSA 202208-34 and the NetApp Security Advisory.

Workarounds

• Remove or undeploy the examples web application (webapps/examples) from all Tomcat instances, especially in production environments
• If the examples application must remain deployed, restrict access to it using Tomcat's security constraints or firewall rules to limit exposure to trusted networks only
• Implement a reverse proxy with XSS filtering capabilities in front of Tomcat servers

# Remove the examples web application from Tomcat
rm -rf $CATALINA_HOME/webapps/examples

# Or disable it by removing from server.xml or renaming the directory
mv $CATALINA_HOME/webapps/examples $CATALINA_HOME/webapps/examples.disabled

# Restart Tomcat to apply changes
$CATALINA_HOME/bin/shutdown.sh
$CATALINA_HOME/bin/startup.sh