CVE-2023-49735: Apache Tiles: Unvalidated input may lead to path traversal and XXE
UNSUPPORTED WHEN ASSIGNED
The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles.
This issue affects Apache Tiles from version 2 onwards.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Other sources
Apache Tiles could allow a remote attacker to traverse directories on the system, caused by improper validation of the DefaultLocaleResolver.LOCALEKEY attribute on the session. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49735?
CVE-2023-49735 is considered to have a high severity due to the potential for path traversal and SSRF/XXE vulnerabilities.
How do I fix CVE-2023-49735?
To fix CVE-2023-49735, ensure that the DefaultLocaleResolver.LOCALE_KEY attribute is properly validated before usage.
What software is affected by CVE-2023-49735?
CVE-2023-49735 affects Apache Tiles versions 2.0.0 and higher, as well as IBM Cognos Controller versions 11.0.0 to 11.0.1.
What kind of attacks can CVE-2023-49735 enable?
CVE-2023-49735 can enable path traversal attacks and potentially lead to server-side request forgery (SSRF) and XML external entity (XXE) vulnerabilities.
Is there a workaround for CVE-2023-49735?
A viable workaround for CVE-2023-49735 is to disable or restrict the handling of user-controlled data in the DefaultLocaleResolver.LOCALE_KEY attribute.