CVE-2023-41081

What it actually does

mod_jk performs implicit request mapping to the first defined worker when JkOptions +ForwardDirectories is enabled without explicit mounts for all proxied paths, exposing the status worker or bypassing httpd security constraints.

Why it matters to the business

Attackers may obtain internal status information or reach resources that should be protected, increasing the chance of further compromise or data exposure in Apache HTTPD setups using mod_jk.

How an attack unfolds

An attacker sends HTTP requests to paths not covered by explicit worker mounts; mod_jk implicitly routes them to the first worker (commonly the status worker), bypassing configured access controls and revealing sensitive connector status or other proxied content.

How to fix it

Upgrade apache/tomcat-connectors to the version containing commit 3ad622409ae3335df9f353bef8ebc4d72a70fd6d (equivalent to 1.2.49). Replace all implicit mappings with explicit JkMount or JkUnMount directives and remove reliance on ForwardDirectories for security decisions.

How to confirm the fix worked

Confirm the installed mod_jk version is 1.2.49 or newer; audit httpd configuration for the absence of JkOptions +ForwardDirectories without corresponding explicit mounts for every possible path; test that requests to unmapped paths now return 404 or are explicitly denied rather than routed to the first worker.

Typical attack path

1. Identify a Tomcat Connectors deployment using mod_jk with JkOptions +ForwardDirectories enabled
2. Send requests to unmapped paths that trigger implicit routing
3. Reach the status worker or other unintended backend resources
4. Extract connector status details or access protected content

How to detect it

Search web-server access logs for requests that resolve to the status worker without an explicit mount entry; review mod_jk configuration files for the presence of JkOptions +ForwardDirectories combined with missing explicit JkMount directives; monitor for unexpected access to /jkstatus or similar status endpoints.

• JkOptions +ForwardDirectories
• jkstatus
• mod_jk implicit mapping

What your security team should do

• Upgrade mod_jk to 1.2.49 or the fixed commit immediately
• Replace any JkOptions +ForwardDirectories usage with explicit mount rules
• Review all worker definitions and ensure no status worker is reachable via implicit paths
• Add configuration review to change-management processes for future mod_jk deployments