CVE-2023-49735: Apache Tiles Path Traversal Vulnerability

CVE-2023-49735 Overview

CVE-2023-49735 is a path traversal vulnerability in Apache Tiles that can lead to Server-Side Request Forgery (SSRF) and XML External Entity (XXE) attacks. The vulnerability exists in how the DefaultLocaleResolver.LOCALE_KEY attribute on the session is handled during XML definition file resolution. When user-controlled data is passed to this key, the value is not properly validated, allowing attackers to manipulate file paths and potentially access internal resources or execute XXE attacks.

Critical Impact

This vulnerability affects an unsupported product (Apache Tiles version 2 onwards) and allows unauthenticated remote attackers to exploit path traversal to achieve SSRF/XXE, potentially exposing sensitive internal data or enabling further attacks against backend systems.

Affected Products

• Apache Tiles version 2 and later
• Applications using Apache Tiles with user-controlled locale settings
• Applications based on the 'tiles-test' application pattern shipped with Tiles

Discovery Timeline

• 2023-11-30 - CVE-2023-49735 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-49735

Vulnerability Analysis

The vulnerability stems from insufficient input validation in Apache Tiles' locale resolution mechanism. When an application sets the DefaultLocaleResolver.LOCALE_KEY attribute on an HTTP session, Apache Tiles uses this value to resolve XML definition files for the templating framework. The critical flaw is that this value is not validated or sanitized before being used in file path construction.

This design pattern was commonly used in applications to allow users to select their preferred language, as demonstrated in the 'tiles-test' application shipped with the framework. Attackers can exploit this by injecting path traversal sequences (such as ../) into the locale value, allowing them to navigate outside the intended directory structure and access arbitrary files on the server.

The exploitation can escalate to SSRF when the path traversal is combined with XML file resolution, and further to XXE if the XML parser is configured to process external entities. This chain of vulnerabilities allows attackers to make requests to internal services, exfiltrate data, or potentially achieve remote code execution depending on the target environment.

Root Cause

The root cause is a classic CWE-22 (Path Traversal) vulnerability where user-controlled input is directly concatenated into file system paths without proper validation or canonicalization. The DefaultLocaleResolver class accepts locale values that can contain directory traversal sequences, allowing attackers to escape the intended definition file directory and access or reference files elsewhere on the file system.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an application that uses Apache Tiles with session-based locale management
2. Manipulating the locale value (typically through request parameters or cookies) to include path traversal sequences
3. Triggering the application to resolve XML definition files using the malicious locale value
4. Leveraging the path traversal to access sensitive files or craft XXE payloads for SSRF attacks

The vulnerability is particularly dangerous because passing user-controlled data to the LOCALE_KEY was a common pattern encouraged by the example applications shipped with Apache Tiles.

Detection Methods for CVE-2023-49735

Indicators of Compromise

• Web server logs containing path traversal sequences (../, ..%2f, %2e%2e/) in locale-related parameters
• Unexpected XML parsing errors or external entity resolution attempts in application logs
• Outbound network connections from the application server to unexpected internal or external hosts
• Unusual file access patterns in system audit logs, particularly reads outside the web application directory

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Monitor application logs for XML parsing exceptions and external entity resolution warnings
• Deploy network monitoring to detect SSRF attempts, including connections to internal services from web application servers
• Use runtime application self-protection (RASP) solutions to detect path traversal and XXE exploitation attempts

Monitoring Recommendations

• Enable verbose logging for XML parsers to capture external entity resolution attempts
• Configure security information and event management (SIEM) rules to alert on path traversal patterns in web traffic
• Monitor egress network traffic from application servers for unexpected destinations
• Implement file integrity monitoring on sensitive configuration files that could be targeted via path traversal

How to Mitigate CVE-2023-49735

Immediate Actions Required

• Audit applications for usage of DefaultLocaleResolver.LOCALE_KEY with user-controlled input
• Implement strict input validation on all locale-related parameters, allowing only alphanumeric locale codes
• Disable XML external entity processing in all XML parsers used by the application
• Consider migrating away from Apache Tiles as it is no longer supported by the maintainer

Patch Information

Apache Tiles is no longer maintained by the Apache Software Foundation. As noted in the CVE description, this vulnerability affects products that are no longer supported by the maintainer. Organizations using Apache Tiles should consider migrating to actively maintained templating frameworks.

For more information, see the Apache Security Mailing List Thread.

Workarounds

• Implement application-level input validation to whitelist allowed locale values (e.g., en, en_US, fr_FR)
• Configure XML parsers to disable external entity processing and DTD loading
• Deploy a reverse proxy or WAF to filter requests containing path traversal sequences
• Isolate applications using Apache Tiles in network segments with restricted outbound access to mitigate SSRF impact

# Example: Disable XXE in Java XML parsers
# Add these JVM arguments or configure programmatically
-Djavax.xml.accessExternalDTD=""
-Djavax.xml.accessExternalSchema=""