How to remediate – Apache Tomcat Snoop Servlet Remote Information Disclosure

1. Introduction

The Apache Tomcat Snoop Servlet Remote Information Disclosure vulnerability allows an attacker to gain sensitive information about a web server, such as kernel version and PATH variables. This can aid in further attacks against the system. Affected systems are typically Apache Tomcat web servers with the ‘snoop’ servlet installed. A successful exploit could lead to a compromise of confidentiality.

2. Technical Explanation

The vulnerability exists because the ‘snoop’ servlet provides excessive information about the host environment. An attacker can request this information remotely, revealing details that should not be publicly accessible. The CVE associated with this issue is CVE-2000-0760. A remote attacker could send a simple HTTP request to the snoop servlet endpoint to retrieve sensitive system data.

• Root cause: Excessive information disclosure by the ‘snoop’ Tomcat servlet.
• Exploit mechanism: An attacker sends an HTTP request to the servlet, which returns host environment details. For example, accessing http://target/snoop.
• Scope: Apache Tomcat web servers with the ‘snoop’ servlet installed.

3. Detection and Assessment

To confirm vulnerability, check for the presence of the ‘snoop’ servlet. A thorough method involves examining the Tomcat configuration files.

• Quick checks: Check if the /snoop endpoint is accessible via a web browser or using `curl`.
• Scanning: Nessus plugin ID 16043 may detect this vulnerability, but results should be verified.
• Logs and evidence: Examine Tomcat access logs for requests to the `/snoop` endpoint.

curl http://target/snoop

4. Solution / Remediation Steps

The solution is to delete the ‘snoop’ servlet from the Tomcat installation. This removes the information disclosure risk.

4.1 Preparation

• No dependencies are required, but ensure you have appropriate permissions to modify Tomcat’s deployment directory.

4.2 Implementation

1. Step 1: Locate the ‘snoop’ servlet file within your Tomcat web application’s deployment directory (typically in webapps).
2. Step 2: Delete the ‘snoop’ servlet file and any associated JAR files or directories.
3. Step 3: Restart the Tomcat service to apply the changes.

4.3 Config or Code Example

Before

# Servlet directory exists in webapps:
/opt/tomcat/webapps/snoop/

After

# Servlet directory no longer exists:
/opt/tomcat/webapps/  (no snoop directory)

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability include least privilege and secure defaults. Least privilege reduces the impact if exploited, while secure defaults prevent unnecessary services from being installed in the first place.

• Practice 1: Apply the principle of least privilege by limiting access to sensitive system information.
• Practice 2: Avoid installing unnecessary servlets or applications that could introduce security risks.

4.5 Automation (Optional)

# Example Bash script to remove the snoop directory:
#!/bin/bash
TOMCAT_HOME="/opt/tomcat"
if [ -d "$TOMCAT_HOME/webapps/snoop" ]; then
  rm -rf "$TOMCAT_HOME/webapps/snoop"
  echo "Removed snoop servlet."
else
  echo "Snoop servlet not found."
fi
# Restart Tomcat service (adjust command as needed)
systemctl restart tomcat

5. Verification / Validation

Confirm the fix by checking that the ‘snoop’ endpoint is no longer accessible. A negative test involves attempting to access the endpoint and verifying a 404 error.

• Post-fix check: Attempt to access http://target/snoop. Expected output: HTTP 404 Not Found.
• Re-test: Re-run the `curl` command from Section 3 and confirm it returns a 404 error.
• Smoke test: Verify that other web applications hosted on Tomcat are still functioning correctly.
• Monitoring: Monitor Tomcat access logs for any unexpected requests to `/snoop`.

curl http://target/snoop

6. Preventive Measures and Monitoring

Update security baselines to prevent the installation of unnecessary servlets like ‘snoop’. Implement CI/CD pipeline checks to scan for known vulnerabilities in deployed applications. A sensible patch review cycle should be established based on risk assessment.

• Baselines: Update your Tomcat security baseline or policy to disallow the installation of potentially vulnerable servlets.
• Pipelines: Add static application security testing (SAST) tools to your CI/CD pipeline to identify and block deployments with known vulnerabilities.
• Asset and patch process: Implement a regular review cycle for installed applications and patches, based on risk assessment.

7. Risks, Side Effects, and Roll Back

Removing the ‘snoop’ servlet should not impact other web applications unless it was specifically used by them. The roll back steps involve restoring the backed-up configuration files and restarting the Tomcat service.

• Risk or side effect 1: If another application depends on the ‘snoop’ servlet, removing it may cause functionality to break.
• Risk or side effect 2: Incorrectly modifying Tomcat’s configuration could lead to service instability.
• Roll back: Restore the backed-up Tomcat configuration directory and restart the Tomcat service.

8. References and Resources

• Vendor advisory or bulletin: SecurityFocus BID 1532
• NVD or CVE entry: CVE-2000-0760
• Product or platform documentation relevant to the fix: Apache Tomcat Security