Vulnerability with tomcat when adding "/" to the URL

Products

• CA Service Management - Service Desk Manager

Issue/Introduction

Adding forward slash "/" to the SDM URL using tomcat port is downloading a file.

Steps:

1. In the SDM URL adding "/" as -  http://hostname/CAisd/pdmweb.exe../

2. A .exe file will be downloaded while accessing. 

Environment

Release : 17.3

Component : SDM - Other

Resolution

This is addressed via defect DE65040 and it is fixed through rewrite rules configured in tomcat.
Please follow the below steps:

1) In CATALINA_BASE\conf\context.xml  add below:
<Valve className="org.apache.catalina.valves.rewrite.RewriteValve" />

2) create an CATALINA_BASE\webapps\CAisd\WEB-INF\rewrite.config with :

RewriteRule ^/pdmweb([0-9]?).exe(.+) /html/noconnect.html [F,L]
RewriteRule ^/pdmweb_d.exe(.+) /html/noconnect.html [F,L]
RewriteRule ^/pdmweb_debug.exe(.+) /html/noconnect.html [F,L]
RewriteRule ^/pdmweb_wsp.exe(.+) /html/noconnect.html [F,L]
RewriteRule ^/pdm_cgireport.exe(.+) /html/noconnect.html [F,L]

3) Restart SDM Tomcat or CA Service Desk Manager Server service