CVE-2024-56337
📋 TL;DR
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat allows attackers to bypass security checks and write malicious files to case-insensitive file systems. This affects Tomcat versions 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, 9.0.0.M1 through 9.0.97, and potentially older EOL versions. The vulnerability specifically impacts systems with the default servlet write enabled on case-insensitive file systems.
💻 Affected Systems
- Apache Tomcat
📦 What is this software?
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Unauthorized file upload allowing web shell installation and subsequent lateral movement.
If Mitigated
No impact if proper Java system properties are configured or patched versions are used.
🎯 Exploit Status
Requires race condition timing and specific configuration. CVSS 9.8 indicates critical severity with network access and no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Tomcat 11.0.3, 10.1.35, 9.0.99
Vendor Advisory: https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp
Restart Required: Yes
Instructions:
1. Download patched version from Apache Tomcat website. 2. Stop Tomcat service. 3. Backup configuration files. 4. Replace Tomcat installation with patched version. 5. Restore configuration files. 6. Start Tomcat service.
🔧 Temporary Workarounds
Java System Property Configuration
allSet sun.io.useCanonCaches to false based on Java version
For Java 8/11: -Dsun.io.useCanonCaches=false
For Java 17: Ensure -Dsun.io.useCanonCaches=false if set
For Java 21+: No action needed
Disable Default Servlet Write
allSet readonly parameter to true in default servlet configuration
In web.xml: <init-param><param-name>readonly</param-name><param-value>true</param-value></init-param>
🧯 If You Can't Patch
- Configure Java system property sun.io.useCanonCaches=false in Tomcat startup scripts
- Disable default servlet write capability by setting readonly=true in web.xml
🔍 How to Verify
Check if Vulnerable:
Check Tomcat version with catalina.sh version or version.bat, verify default servlet readonly parameter is false, confirm case-insensitive file systemCheck Version:
catalina.sh version (Linux/macOS) or version.bat (Windows)Verify Fix Applied:
Verify Tomcat version is 11.0.3+, 10.1.35+, or 9.0.99+, check Java system property sun.io.useCanonCaches is false if applicable📡 Detection & Monitoring
Log Indicators:
- Unexpected file writes to web application directories
- Multiple rapid requests to default servlet endpoints
- Error logs mentioning canonicalization cache
Network Indicators:
- Unusual PUT/POST requests to default servlet paths
- Rapid sequence of file upload requests
SIEM Query:
source="tomcat" AND (http_method="PUT" OR http_method="POST") AND uri="/default/*" AND count > 10 within 1s