Apache Tomcat Vulnerability CVE-2024

Webmin, a widely used web-based administration tool for Unix and Linux servers, contains an OS command injection flaw (CWE-78, ZDI-CAN-22346) in its handling of CGI requests: a user-supplied string is not properly validated before being used in a system call. An attacker with valid low-privilege credentials can trigger the flaw remotely by sending a crafted CGI request with injected shell commands. Successful exploitation yields arbitrary code execution in the context of root, giving the attacker full control over the affected host. Any organization running Webmin whose web interface is reachable from a network the attacker can access is in scope, including instances exposed to the internet on the default port 10000. No public proof-of-concept or CISA KEV listing exists yet, but EPSS assigns a 33.5% probability of exploitation within 30 days (98th percentile), indicating a meaningful near-term threat.

Do: Upgrade Webmin to the fixed release identified in the vendor/ZDI advisory as soon as possible; the available data does not state specific affected or fixed version numbers, so verify the fixed version in Webmin's release notes. Until patched, restrict access to the Webmin interface (default TCP 10000) to trusted networks or a VPN, and audit which accounts hold Webmin credentials since valid authentication is required to exploit. Review web-server and Webmin logs for anomalous CGI requests containing shell metacharacters that could indicate exploitation attempts.

CVE-2024-50379 is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in Apache Tomcat's JSP compilation path that permits unauthenticated remote code execution when Tomcat runs on a case-insensitive file system and the default servlet is enabled for write, which is a non-default configuration. An attacker who can upload or modify files through the write-enabled default servlet can race the JSP compiler so that an altered file is compiled and executed in place of the version that was checked, yielding code execution in the context of the Tomcat process (CVSS 3.1 9.8, network vector with no privileges required). Affected versions are 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97, plus EOL releases 8.5.0 through 8.5.100 and possibly older EOL versions; NetApp products that embed Apache Tomcat are also listed as affected. The flaw is fixed in Tomcat 11.0.2, 10.1.34, and 9.0.98. As of this analysis there is no CISA KEV entry and no public PoC or confirmed in-the-wild exploitation is known, but EPSS assigns a 44.3% probability of exploitation within 30 days (99th percentile), making this a high-priority patch.

Do: Upgrade Tomcat to 11.0.2, 10.1.34, or 9.0.98 as applicable; EOL 8.5.x deployments should migrate to a supported branch since no further 8.5 fixes are listed. Check whether your deployment runs on a case-insensitive file system (e.g., Windows, macOS) and whether the default servlet is enabled for write; if it is read-only, the exposure under the current description is low. NetApp customers should review NetApp security advisories for their products that embed Tomcat.

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.