Apache Tomcat 'pipelined' Requests Information Disclosure Vulnerability (Apr 2017) - Windows

# SPDX-FileCopyrightText: 2017 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:apache:tomcat";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.810762");
  script_version("2025-12-12T15:41:28+0000");
  script_cve_id("CVE-2017-5647");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_tag(name:"last_modification", value:"2025-12-12 15:41:28 +0000 (Fri, 12 Dec 2025)");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2019-04-15 16:31:00 +0000 (Mon, 15 Apr 2019)");
  script_tag(name:"creation_date", value:"2017-04-21 15:34:00 +0530 (Fri, 21 Apr 2017)");
  script_tag(name:"qod_type", value:"remote_banner");
  script_name("Apache Tomcat 'pipelined' Requests Information Disclosure Vulnerability (Apr 2017) - Windows");

  script_tag(name:"summary", value:"Apache Tomcat is prone to an information disclosure vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"A bug in the handling of the pipelined
  requests when send file was used resulted in the pipelined request being
  lost when send file processing of the previous request completed.");

  script_tag(name:"impact", value:"Successful exploitation will allow remote
  attackers to obtain sensitive information from requests other than their own.");

  script_tag(name:"affected", value:"Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18,
  Apache Tomcat versions 8.5.0 to 8.5.12,
  Apache Tomcat versions 8.0.0.RC1 to 8.0.42,
  Apache Tomcat versions 7.0.0 to 7.0.76 and
  Apache Tomcat versions 6.0.0 to 6.0.52 on Windows.");

  script_tag(name:"solution", value:"Upgrade to version 9.0.0.M19,
  8.5.13, 8.0.43, 7.0.77, 6.0.53  or later.");

  script_tag(name:"solution_type", value:"VendorFix");
  script_xref(name:"URL", value:"http://tomcat.apache.org/security-9.html");
  script_xref(name:"URL", value:"http://tomcat.apache.org/security-8.html");
  script_xref(name:"URL", value:"http://tomcat.apache.org/security-7.html");
  script_xref(name:"URL", value:"http://tomcat.apache.org/security-6.html");
  script_xref(name:"URL", value:"https://lists.apache.org/thread.html/5796678c5a773c6f3ff57c178ac247d85ceca0dee9190ba48171451a@%3Cusers.tomcat.apache.org%3E");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2017 Greenbone AG");
  script_family("Web Servers");
  script_dependencies("gb_apache_tomcat_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("apache/tomcat/detected", "Host/runs_windows");
  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if(isnull(port = get_app_port(cpe:CPE)))
  exit(0);

if(!infos = get_app_version_and_location(cpe:CPE, port:port, exit_no_version:TRUE))
  exit(0);

vers = infos["version"];
path = infos["location"];

if(vers =~ "^[6-9]\.") {
  if(version_in_range(version:vers, test_version:"6.0.0", test_version2:"6.0.52")) {
    fix = "6.0.53";
    VULN = TRUE;
  }

  else if(version_in_range(version:vers, test_version:"7.0.0", test_version2:"7.0.76")) {
    fix = "7.0.77";
    VULN = TRUE;
  }

  else if(version_in_range(version:vers, test_version:"8.5.0", test_version2:"8.5.12")) {
    fix = "8.5.13";
    VULN = TRUE;
  }

  else if(version_in_range(version:vers, test_version:"8.0.0.RC1", test_version2:"8.0.42")) {
    fix = "8.0.43";
    VULN = TRUE;
  }

  else if(version_in_range(version:vers, test_version:"9.0.0.M1", test_version2:"9.0.0.M18")) {
    fix = "9.0.0.M19";
    VULN = TRUE;
  }

  if(VULN) {
    report = report_fixed_ver(installed_version:vers, fixed_version:fix, install_path:path);
    security_message(port:port, data:report);
    exit(0);
  }
}

exit(99);