CVE-2023-41080 Overview
CVE-2023-41080 is an open redirect vulnerability [CWE-601] in the FORM authentication feature of Apache Tomcat. The flaw allows an attacker to craft a URL that, after authentication, redirects the victim to an attacker-controlled site. Exploitation requires user interaction and is limited to the ROOT (default) web application.
The issue affects Apache Tomcat 11.0.0-M1 through 11.0.0-M10, 10.1.0-M1 through 10.0.12, 9.0.0-M1 through 9.0.79, and 8.5.0 through 8.5.92. Older, end-of-life versions may also be affected. Debian Linux 10 and 11 distributions ship vulnerable Tomcat packages addressed via DSA-5521 and DSA-5522.
Critical Impact
Attackers can leverage trusted Tomcat-hosted login flows to redirect authenticated users to phishing or malware-hosting domains, enabling credential theft and downstream account compromise.
Affected Products
- Apache Tomcat 8.5.0 through 8.5.92
- Apache Tomcat 9.0.0-M1 through 9.0.79
- Apache Tomcat 10.1.0-M1 through 10.0.12 and 11.0.0-M1 through 11.0.0-M10
- Debian Linux 10 and 11 (Tomcat packages)
Discovery Timeline
- 2023-08-25 - CVE-2023-41080 published to NVD
- 2025-08-07 - Last updated in NVD database
Technical Details for CVE-2023-41080
Vulnerability Analysis
The vulnerability resides in how the Apache Tomcat FORM authentication mechanism (j_security_check) handles redirect targets after successful login. When a user attempts to access a protected resource, Tomcat stores the originally requested URL and redirects the user to it after authentication.
In affected versions, the ROOT web application accepts attacker-supplied URLs that resolve to external destinations rather than restricting them to local application paths. After successful FORM authentication, Tomcat issues an HTTP redirect to that untrusted location. The flaw is classified as URL Redirection to Untrusted Site [CWE-601].
Exploitation impacts confidentiality and integrity at a limited scope but can have a high practical impact because the redirect originates from a legitimate, trusted application origin. This makes the resulting phishing pages significantly more convincing to victims.
Root Cause
The FORM authentication handler in the ROOT application fails to validate that the post-authentication redirect URL belongs to the same application or origin. Tomcat treats the saved request URI as trusted input without enforcing host or path constraints, allowing absolute URLs pointing to external domains.
Attack Vector
An attacker crafts a URL pointing at the Tomcat ROOT application's FORM authentication endpoint with a manipulated saved request that resolves to an external domain. The attacker then distributes this URL through email, chat, or web links. When the victim authenticates, Tomcat issues a 302 redirect to the attacker-controlled site, which can host a fake login page or malware. EPSS data places exploitation probability at 11.586% (93.7 percentile), indicating elevated real-world interest.
No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical detail on the redirect logic and fix is available in the Apache Mailing List Thread.
Detection Methods for CVE-2023-41080
Indicators of Compromise
- HTTP 302 responses from /j_security_check containing Location headers pointing to external domains.
- Access log entries showing POST requests to FORM authentication endpoints followed by redirects to non-local hosts.
- Inbound requests to the Tomcat ROOT context with unusually long or URL-encoded RequestURI parameters in saved-session state.
Detection Strategies
- Inventory Tomcat instances and identify versions falling within the affected ranges using configuration management or vulnerability scanners.
- Inspect Tomcat access_log files for Location header values referencing external hostnames following authentication events.
- Deploy web application firewall (WAF) rules that flag redirect targets resolving to domains outside the application's trusted origin list.
Monitoring Recommendations
- Forward Tomcat access and authentication logs to a centralized SIEM and alert on cross-origin redirect patterns from /j_security_check.
- Monitor outbound user navigation from Tomcat-hosted login flows for redirects to newly registered or low-reputation domains.
- Track repeated FORM authentication requests originating from a single client paired with distinct external redirect targets.
How to Mitigate CVE-2023-41080
Immediate Actions Required
- Upgrade Tomcat to patched versions: 11.0.0-M11 or later, 10.1.13 or later, 9.0.80 or later, or 8.5.93 or later.
- Apply Debian package updates per DSA-5521 and DSA-5522 on affected Debian 10 and 11 systems.
- Review whether the ROOT (default) web application is required in production; remove or replace it if unnecessary.
Patch Information
The Apache Tomcat project addressed the issue in 8.5.93, 9.0.80, 10.1.13, and 11.0.0-M11. Refer to the Apache Mailing List Thread for the original advisory and the NetApp Security Advisory and Debian LTS Announcement for downstream guidance.
Workarounds
- Remove or replace the Tomcat ROOT web application, since the vulnerability is limited to that context.
- Front Tomcat with a reverse proxy or WAF that strips or validates Location response headers against an allowlist of internal domains.
- Disable FORM authentication on the ROOT context and switch to BASIC, DIGEST, or an external identity provider where feasible.
# Configuration example: remove the ROOT web application to eliminate exposure
rm -rf $CATALINA_HOME/webapps/ROOT
rm -rf $CATALINA_HOME/webapps/ROOT.war
# Restart Tomcat to apply
systemctl restart tomcat
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
