CVE-2024-50379
📋 TL;DR
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat's JSP compilation allows attackers to achieve Remote Code Execution (RCE) on case-insensitive file systems when the default servlet is configured for write operations. This affects Tomcat versions 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97, plus some EOL versions. The vulnerability requires a non-default configuration where the default servlet has write permissions.
💻 Affected Systems
- Apache Tomcat
📦 What is this software?
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining remote code execution as the Tomcat service account, potentially leading to data theft, lateral movement, or ransomware deployment.
Likely Case
Attackers upload malicious JSP files to execute arbitrary code, compromising the Tomcat server and potentially accessing sensitive application data.
If Mitigated
Limited impact if default servlet write permissions are disabled and proper file system permissions are enforced.
🎯 Exploit Status
Exploitation requires precise timing and specific configuration conditions, but successful attacks lead to RCE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.2, 10.1.34, or 9.0.98
Vendor Advisory: https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
Restart Required: Yes
Instructions:
1. Download patched version from Apache Tomcat website. 2. Stop Tomcat service. 3. Backup configuration and applications. 4. Replace Tomcat installation with patched version. 5. Restore configuration and applications. 6. Start Tomcat service.
🔧 Temporary Workarounds
Disable Default Servlet Write Permissions
allRemove write permissions from the default servlet in web.xml configuration
Edit $CATALINA_HOME/conf/web.xml and ensure <servlet><servlet-name>default</servlet-name> does not have write permissions enabled
Use Case-Sensitive File System
linuxDeploy Tomcat on case-sensitive file systems where possible
🧯 If You Can't Patch
- Disable default servlet write permissions immediately
- Implement strict network access controls to limit Tomcat exposure
🔍 How to Verify
Check if Vulnerable:
Check Tomcat version and verify if default servlet has write permissions enabled in web.xmlCheck Version:
java -cp "$CATALINA_HOME/lib/catalina.jar" org.apache.catalina.util.ServerInfoVerify Fix Applied:
Confirm Tomcat version is 11.0.2, 10.1.34, or 9.0.98 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual JSP compilation errors
- Multiple rapid file upload attempts to default servlet
- Suspicious file creation in webapps directory
Network Indicators:
- HTTP PUT requests to Tomcat default servlet endpoints
- Unusual outbound connections from Tomcat process
SIEM Query:
source="tomcat" AND (event="JSP compilation error" OR event="file upload" OR method="PUT")🔗 References
- https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
- http://www.openwall.com/lists/oss-security/2024/12/17/4
- http://www.openwall.com/lists/oss-security/2024/12/18/2
- https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
- https://security.netapp.com/advisory/ntap-20250103-0003/
