Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request

CVE-2023-41081

Summary

The mod_jk component of Apache Tomcat Connectors allows for an authentication bypass under specific configuration conditions. If 'JkOptions +ForwardDirectories' is used without providing explicit mounts for all proxied requests, mod_jk defaults to an implicit mapping. This can inadvertently expose the status worker and compromise security constraints set in Apache HTTP Server. Users are advised to upgrade to mod_jk version 1.2.49 or later, where the problematic implicit mapping functionality has been eliminated, ensuring all mappings require explicit configuration.

References