BIT-tomcat-2024-50379: Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

Q: Which deployments are exposed to this issue?

Affected deployments use Apache Tomcat on a case-insensitive file system and have the default servlet enabled for write. Write access in the default servlet is a non-default configuration.

Q: What does an attacker need to exploit the vulnerability?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction, according to the supplied CVSS vector. The vulnerable configuration must also meet the case-insensitive file system and writable default-servlet conditions.

Q: Which versions should be remediated?

Affected supported release ranges are Tomcat 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97. Upgrade to 11.0.2, 10.1.34, or 9.0.98 respectively; 8.5.0 through 8.5.100 is also known to be affected but was already end of life.

Q: What can be done if an upgrade cannot be applied immediately?

Disable write access for the default servlet where possible. This removes the non-default configuration condition identified for exploitation.

Published Dec 17, 2024

Updated

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

Affected Software

1 affected component

Apache Tomcat>=11.0.0-M1<=11.0.1, >=10.1.0-M1<=10.1.33, >=9.0.0.M1<=9.0.97, >=8.5.0<=8.5.100

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 11.0.2
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 10.1.34
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 9.0.98

Event History

Dec 17, 2024

CVE Published

via OSV·12:34 PM

Data Sourced

via OSV·12:34 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Affected deployments use Apache Tomcat on a case-insensitive file system and have the default servlet enabled for write. Write access in the default servlet is a non-default configuration.

What does an attacker need to exploit the vulnerability?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction, according to the supplied CVSS vector. The vulnerable configuration must also meet the case-insensitive file system and writable default-servlet conditions.

Which versions should be remediated?

Affected supported release ranges are Tomcat 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97. Upgrade to 11.0.2, 10.1.34, or 9.0.98 respectively; 8.5.0 through 8.5.100 is also known to be affected but was already end of life.

What can be done if an upgrade cannot be applied immediately?

Disable write access for the default servlet where possible. This removes the non-default configuration condition identified for exploitation.

BIT-tomcat-2024-50379: Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Which versions should be remediated?

What can be done if an upgrade cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Which versions should be remediated?

What can be done if an upgrade cannot be applied immediately?