Miggo Logo
Miggo Vulnerability Database
→
CVE-2013-2185

CVE-2013-2185: Deserialization of Untrusted Data in Apache Tomcat

N/A

CVSS Score

Basic Information

CVE ID
CVE-2013-2185
GHSA ID
GHSA-v6c7-8qx5-8gmp
EPSS Score
0.89025%
CWE
CWE-502
Published
5/17/2022
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.tomcat:tomcatmaven< 7.0.397.0.39

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly identifies the readObject method in DiskFileItem as the entry point. This method handles deserialization of file upload data but fails to properly sanitize NULL bytes in filenames during deserialization. This allows path traversal attacks by terminating filename validation checks early (via NULL byte injection). The dispute about responsibility doesn't change the technical reality that this method processes untrusted serialized data without adequate safeguards. The first patched version (7.0.39) confirms this was addressed in Tomcat's implementation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** r***O*j**t m*t*o* in t** *isk*il*It*m *l*ss in *p**** Tom**t *n* J*oss W**, *s us** in R** **t J*oss *nt*rpris* *ppli**tion Pl*t*orm *.*.* *n* R** **t J*oss Port*l *.*.*, *llows r*mot* *tt**k*rs to writ* to *r*itr*ry *il*s vi* * NULL *yt* in * *i

Reasoning

T** vuln*r**ility **s*ription *xpli*itly i**nti*i*s t** r***O*j**t m*t*o* in *isk*il*It*m *s t** *ntry point. T*is m*t*o* **n*l*s **s*ri*liz*tion o* *il* uplo** **t* *ut **ils to prop*rly s*nitiz* NULL *yt*s in *il*n*m*s *urin* **s*ri*liz*tion. T*is