CVE-2022-23181
📋 TL;DR
This CVE describes a time-of-check-time-of-use (TOCTOU) vulnerability in Apache Tomcat that allows local attackers to escalate privileges. The vulnerability only affects systems where Tomcat is configured to persist sessions using FileStore. Attackers can perform actions with the privileges of the Tomcat process user.
💻 Affected Systems
- Apache Tomcat
📦 What is this software?
Agile Engineering Data Management by Oracle
Communications Cloud Native Core Policy by Oracle
View all CVEs affecting Communications Cloud Native Core Policy →
Financial Services Crime And Compliance Management Studio by Oracle
View all CVEs affecting Financial Services Crime And Compliance Management Studio →
Financial Services Crime And Compliance Management Studio by Oracle
View all CVEs affecting Financial Services Crime And Compliance Management Studio →
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full control of the Tomcat process, potentially leading to complete system compromise if Tomcat runs with elevated privileges.
Likely Case
Local attacker modifies session data, potentially hijacking user sessions or executing arbitrary code within Tomcat context.
If Mitigated
Minimal impact if Tomcat runs with minimal privileges and proper access controls are in place.
🎯 Exploit Status
Requires local access to the system and specific FileStore configuration. Exploitation involves race condition timing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Tomcat 10.1.0-M9, 10.0.15, 9.0.57, 8.5.74 and later
Vendor Advisory: https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
Restart Required: Yes
Instructions:
1. Download patched Tomcat version from Apache website. 2. Stop Tomcat service. 3. Backup configuration files. 4. Replace Tomcat installation with patched version. 5. Restore configuration files. 6. Start Tomcat service.
🔧 Temporary Workarounds
Disable FileStore Session Persistence
allSwitch from FileStore to MemoryStore or other session persistence methods
Modify context.xml or server.xml to remove or comment out <Manager className="org.apache.catalina.session.PersistentManager" saveOnRestart="true"> configuration
Restrict File Permissions
linuxSet strict permissions on Tomcat session directory
chmod 700 $CATALINA_BASE/work/Catalina/localhost
chown tomcat:tomcat $CATALINA_BASE/work/Catalina/localhost
🧯 If You Can't Patch
- Run Tomcat with minimal privileges using a dedicated low-privilege user account
- Implement strict access controls to prevent local users from accessing Tomcat server
🔍 How to Verify
Check if Vulnerable:
Check Tomcat version and session persistence configuration. If using FileStore and version is in affected range, system is vulnerable.Check Version:
java -cp $CATALINA_HOME/lib/catalina.jar org.apache.catalina.util.ServerInfoVerify Fix Applied:
Verify Tomcat version is 10.1.0-M9+, 10.0.15+, 9.0.57+, or 8.5.74+📡 Detection & Monitoring
Log Indicators:
- Unauthorized file access attempts in Tomcat logs
- Session corruption or modification events
Network Indicators:
- None - this is a local attack
SIEM Query:
source="tomcat" AND (event="session_corruption" OR event="file_access_violation")🔗 References
- https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
- https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
- https://security.netapp.com/advisory/ntap-20220217-0010/
- https://www.debian.org/security/2022/dsa-5265
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
- https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
- https://security.netapp.com/advisory/ntap-20220217-0010/
- https://www.debian.org/security/2022/dsa-5265
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
