CVE-2019-0232: Remote Code Execution in org.apache.tomcat.embed:tomcat-embed-core
Summary
CVE-2019-0232: Apache Tomcat OS Command Injection vulnerability. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
>= 7.0.0, < 7.0.94
>= 8.0.0, < 8.5.40
>= 9.0.0.M1, < 9.0.17
Fixed in 7.0.94, 8.5.40 or 9.0.17, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.tomcat.embed:tomcat-embed-core is a Maven package that provides embedded Tomcat functionality for Java applications. It allows developers to run a Tomcat server within their application, enabling them to deploy and manage web applications. However, versions 7.0.0 to 7.0.93, 8.5.0 to 8.5.39, and 9.0.0.M1 to 9.0.17 of this package are vulnerable to a high severity Remote Code Execution (RCE) vulnerability.
Vulnerability Detail
The vulnerability arises when running org.apache.tomcat.embed:tomcat-embed-core on Windows with the enableCmdLineArguments option enabled. It is caused by a bug in the way the Java Runtime Environment (JRE) passes command line arguments to Windows. This vulnerability allows an attacker to execute arbitrary code remotely. The CGI Servlet in Apache Tomcat is affected by this vulnerability. It is important to note that the CGI Servlet is disabled by default, and the enableCmdLineArguments option is also disabled by default in Tomcat 9.0.x (and will be disabled in all versions in response to this vulnerability). For more technical details, refer to Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and the archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.947.0.94 -
>= 8.0.0, < 8.5.408.5.40 -
>= 9.0.0.M1, < 9.0.179.0.17
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is advised to disable the CGI Servlet and the enableCmdLineArguments option if they are not required for the application's functionality. This can be done by modifying the Tomcat configuration files.
Conclusion
The vulnerability in org.apache.tomcat.embed:tomcat-embed-core can lead to remote code execution, allowing attackers to execute arbitrary code on the affected system. To mitigate this risk, it is crucial to upgrade to the fixed versions of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
org.apache.tomcat.embed:tomcat-embed-core is a Maven package that provides embedded Tomcat functionality for Java applications. It allows developers to run a Tomcat server within their application, enabling them to deploy and manage web applications.
Versions 7.0.0 to 7.0.93, 8.5.0 to 8.5.39, and 9.0.0.M1 to 9.0.17 of org.apache.tomcat.embed:tomcat-embed-core are affected by this vulnerability.
How does the vulnerability in org.apache.tomcat.embed:tomcat-embed-core allow remote code execution?
The vulnerability arises when running org.apache.tomcat.embed:tomcat-embed-core on Windows with the enableCmdLineArguments option enabled. It is caused by a bug in the way the Java Runtime Environment (JRE) passes command line arguments to Windows. This vulnerability allows an attacker to execute arbitrary code remotely.
No, the CGI Servlet is disabled by default in org.apache.tomcat.embed:tomcat-embed-core.
To fix this vulnerability, it is recommended to upgrade org.apache.tomcat.embed:tomcat-embed-core to version 7.0.94, 8.5.40, or 9.0.17, depending on the version being used.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.