CVE-2021-25122
📋 TL;DR
This vulnerability in Apache Tomcat allows HTTP/2 cleartext (h2c) connections to leak request data between users. When processing h2c requests, Tomcat could duplicate headers and limited body content from one user's request to another's response, potentially exposing sensitive information. Affected users are those running vulnerable Tomcat versions with h2c enabled.
💻 Affected Systems
- Apache Tomcat
📦 What is this software?
Agile Plm by Oracle
Agile Plm by Oracle
Communications Cloud Native Core Policy by Oracle
View all CVEs affecting Communications Cloud Native Core Policy →
Communications Cloud Native Core Security Edge Protection Proxy by Oracle
View all CVEs affecting Communications Cloud Native Core Security Edge Protection Proxy →
Communications Instant Messaging Server by Oracle
View all CVEs affecting Communications Instant Messaging Server →
Database by Oracle
Database by Oracle
Database by Oracle
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
⚠️ Risk & Real-World Impact
Worst Case
User A's sensitive data (authentication tokens, personal information, API keys) appears in User B's response, leading to data breach, session hijacking, or privilege escalation.
Likely Case
Information disclosure where users see fragments of other users' requests, potentially exposing session IDs, form data, or API parameters.
If Mitigated
Limited exposure of non-sensitive headers or request fragments if proper input validation and output encoding are in place elsewhere.
🎯 Exploit Status
Exploitation requires h2c connections and concurrent requests. The vulnerability is in request processing logic, not requiring special payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.2, 9.0.42, 8.5.62
Vendor Advisory: https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
Restart Required: Yes
Instructions:
1. Download patched version from Apache Tomcat website. 2. Stop Tomcat service. 3. Backup configuration files. 4. Replace Tomcat installation with patched version. 5. Restore configuration files. 6. Start Tomcat service.
🔧 Temporary Workarounds
Disable h2c protocol
allDisable HTTP/2 cleartext connections to prevent exploitation
Edit server.xml and remove or comment out <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" /> from Connector configuration
🧯 If You Can't Patch
- Disable HTTP/2 cleartext (h2c) in Tomcat configuration
- Implement network segmentation to isolate Tomcat instances from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check Tomcat version and verify h2c is enabled in server.xml configurationCheck Version:
java -cp "$CATALINA_HOME/lib/catalina.jar" org.apache.catalina.util.ServerInfoVerify Fix Applied:
Verify Tomcat version is 10.0.2+, 9.0.42+, or 8.5.62+ and test h2c connections for data leakage📡 Detection & Monitoring
Log Indicators:
- Unusual request patterns in h2c connections
- Multiple users receiving similar response data
Network Indicators:
- HTTP/2 cleartext traffic to Tomcat ports
- Abnormal request/response patterns in h2c sessions
SIEM Query:
source="tomcat_access.log" protocol="HTTP/2.0" (response_size > normal OR duplicate_content)🔗 References
- http://www.openwall.com/lists/oss-security/2021/03/01/1
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
- https://security.gentoo.org/glsa/202208-34
- https://security.netapp.com/advisory/ntap-20210409-0002/
- https://www.debian.org/security/2021/dsa-4891
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- http://www.openwall.com/lists/oss-security/2021/03/01/1
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
- https://security.gentoo.org/glsa/202208-34
- https://security.netapp.com/advisory/ntap-20210409-0002/
- https://www.debian.org/security/2021/dsa-4891
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
