CVE-2024-50379

CVE-2024-50379 is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in Apache Tomcat's JSP compilation path that permits unauthenticated remote code execution when Tomcat runs on a case-insensitive file system and the default servlet is enabled for write, which is a non-default configuration. An attacker who can upload or modify files through the write-enabled default servlet can race the JSP compiler so that an altered file is compiled and executed in place of the version that was checked, yielding code execution in the context of the Tomcat process (CVSS 3.1 9.8, network vector with no privileges required). Affected versions are 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97, plus EOL releases 8.5.0 through 8.5.100 and possibly older EOL versions; NetApp products that embed Apache Tomcat are also listed as affected. The flaw is fixed in Tomcat 11.0.2, 10.1.34, and 9.0.98. As of this analysis there is no CISA KEV entry and no public PoC or confirmed in-the-wild exploitation is known, but EPSS assigns a 44.3% probability of exploitation within 30 days (99th percentile), making this a high-priority patch.

What to do: Upgrade Tomcat to 11.0.2, 10.1.34, or 9.0.98 as applicable; EOL 8.5.x deployments should migrate to a supported branch since no further 8.5 fixes are listed. Check whether your deployment runs on a case-insensitive file system (e.g., Windows, macOS) and whether the default servlet is enabled for write; if it is read-only, the exposure under the current description is low. NetApp customers should review NetApp security advisories for their products that embed Tomcat.