Apache Foundation fixed a severe Tomcat vulnerability

CVE-2024-50379 is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in Apache Tomcat's JSP compilation path that permits unauthenticated remote code execution when Tomcat runs on a case-insensitive file system and the default servlet is enabled for write, which is a non-default configuration. An attacker who can upload or modify files through the write-enabled default servlet can race the JSP compiler so that an altered file is compiled and executed in place of the version that was checked, yielding code execution in the context of the Tomcat process (CVSS 3.1 9.8, network vector with no privileges required). Affected versions are 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97, plus EOL releases 8.5.0 through 8.5.100 and possibly older EOL versions; NetApp products that embed Apache Tomcat are also listed as affected. The flaw is fixed in Tomcat 11.0.2, 10.1.34, and 9.0.98. As of this analysis there is no CISA KEV entry and no public PoC or confirmed in-the-wild exploitation is known, but EPSS assigns a 44.3% probability of exploitation within 30 days (99th percentile), making this a high-priority patch.

Do: Upgrade Tomcat to 11.0.2, 10.1.34, or 9.0.98 as applicable; EOL 8.5.x deployments should migrate to a supported branch since no further 8.5 fixes are listed. Check whether your deployment runs on a case-insensitive file system (e.g., Windows, macOS) and whether the default servlet is enabled for write; if it is read-only, the exposure under the current description is low. NetApp customers should review NetApp security advisories for their products that embed Tomcat.

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.