Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS — Patch Now

CVE-2024-43441 is a critical (CVSS 9.8) authentication-bypass flaw (CWE-302, Authentication Bypass by Assumed-Immutable Data) in Apache HugeGraph-Server, where the server validates access based on request data it assumes cannot be modified. A remote attacker with network access can send specially crafted requests that tamper with this assumed-immutable data (such as credential/token material supplied in the request), slipping past the authentication layer of the server's API without any valid credentials. The flaw requires no privileges and no user interaction, and once past authentication the attacker gains the access of a legitimate user, with high impact on confidentiality, integrity, and availability of the graph data (CVSS C:H/I:H/A:H). All HugeGraph-Server deployments running version 1.0.0 or later but earlier than 1.5.0 are affected; the flaw is most consequential where authentication was deliberately enabled, since it renders that protection ineffective. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the EPSS score of 69.4% (99th percentile) indicates a high likelihood of exploitation within 30 days, so this should be treated as urgent to patch.

Do: Upgrade Apache HugeGraph-Server to version 1.5.0, which fixes the issue. Until patched, do not rely on authentication to protect exposed instances: locate any HugeGraph-Server reachable from untrusted networks (REST/Gremlin API, by default on port 8080) and restrict access with firewall rules or a reverse proxy. Given the 69.4% EPSS score, review server logs for unexpected unauthenticated API access and watch for follow-on PoC or exploitation reports.

CVE-2024-45387 is an SQL injection flaw in Traffic Ops, the API component of the Apache Traffic Control CDN management platform, affecting version 8.0.0 per the Apache advisory. It is triggered when a user who already holds one of the "admin", "federation", "operations", "portal", or "steering" roles sends a specially crafted PUT request to the Traffic Ops API. Successful injection lets the attacker execute arbitrary SQL against the Traffic Ops database, allowing them to read, modify, or corrupt stored data, consistent with the high confidentiality, integrity, and availability ratings in the 8.8 CVSS score. Any operator running an affected Traffic Ops deployment is exposed, though exploitation requires an authenticated privileged account. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS places this flaw in the 99th percentile with roughly a 41.5% probability of exploitation within 30 days, so patching is urgent.

Do: Upgrade Traffic Ops to Apache Traffic Control 8.0.2 or later as recommended by the advisory. In the meantime, restrict API access to trusted networks and review accounts holding the admin, federation, operations, portal, and steering roles, since any of them can trigger the injection via crafted PUT requests. Check Traffic Ops and database logs for unexpected or anomalous SQL from API activity, and watch for public exploits given the elevated EPSS score.

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.