CVE-2022-23181: Apache Tomcat Local Privilege Escalation
Summary
CVE-2022-23181: Local privilege escalation with FileStore. Affects tomcat across 17 version ranges.
>= 8.5.55, < 8.5.74
>= 9.0.35, < 9.0.57
>= 10.0.0-milestone5, < 10.0.0
>= 10.0.0-milestone6, < 10.0.0
>= 10.0.0-milestone7, < 10.0.0
>= 10.0.0-milestone8, < 10.0.0
>= 10.0.0-milestone9, < 10.0.0
>= 10.0.0-milestone10, < 10.0.0
>= 10.0.1, < 10.0.15
>= 10.1.0-milestone1, < 10.1.0
>= 10.1.0-milestone2, < 10.1.0
>= 10.1.0-milestone3, < 10.1.0
>= 10.1.0-milestone4, < 10.1.0
>= 10.1.0-milestone5, < 10.1.0
>= 10.1.0-milestone6, < 10.1.0
>= 10.1.0-milestone7, < 10.1.0
>= 10.1.0-milestone8, < 10.1.0
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- org.apache.tomcat:tomcat · Maven
- tomcat9 · Debian:11
The same CVE-2022-23181 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. Tomcat supports session persistence using the FileStore, which allows session data to be stored in files on the server's file system. This vulnerability affects versions 8.5.55 to 8.5.73, 9.0.35 to 9.0.56, and 10.0.0-M5 to 10.0.14, as well as 10.1.0-M1 to 10.1.0-M8. The vulnerability allows a local attacker to perform actions with the privileges of the user that the Tomcat process is using.
Vulnerability Detail
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat. This vulnerability can be exploited when Tomcat is configured to persist sessions using the FileStore. A local attacker can take advantage of this vulnerability to perform actions with the privileges of the Tomcat process user. This could lead to unauthorized access, data manipulation, or other malicious activities. The vulnerability has a high severity rating (CVSS score: 3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.5.55, < 8.5.748.5.74 -
>= 9.0.35, < 9.0.579.0.57 -
>= 10.0.0-milestone5, < 10.0.010.0.0 -
>= 10.0.0-milestone6, < 10.0.010.0.0 -
>= 10.0.0-milestone7, < 10.0.010.0.0 -
>= 10.0.0-milestone8, < 10.0.010.0.0
Show all 17 release lines
-
>= 10.0.0-milestone9, < 10.0.010.0.0 -
>= 10.0.0-milestone10, < 10.0.010.0.0 -
>= 10.0.1, < 10.0.1510.0.15 -
>= 10.1.0-milestone1, < 10.1.010.1.0 -
>= 10.1.0-milestone2, < 10.1.010.1.0 -
>= 10.1.0-milestone3, < 10.1.010.1.0 -
>= 10.1.0-milestone4, < 10.1.010.1.0 -
>= 10.1.0-milestone5, < 10.1.010.1.0 -
>= 10.1.0-milestone6, < 10.1.010.1.0 -
>= 10.1.0-milestone7, < 10.1.010.1.0 -
>= 10.1.0-milestone8, < 10.1.010.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a workaround is to disable session persistence using the FileStore. This can be done by modifying the Tomcat configuration to use a different session persistence mechanism, such as a database or an in-memory store. Here is an example of how to configure Tomcat to use an in-memory store:
- Open the 'context.xml' file located in the 'conf' directory of the Tomcat installation.
- Add the following line inside the <Context> element:
<Manager className="org.apache.catalina.session.PersistentManager">
<Store className="org.apache.catalina.session.MapSessionStore"/>
</Manager>
- Save the file and restart Tomcat.
Conclusion
The vulnerability in Apache Tomcat allows a local attacker to escalate privileges and perform actions with the privileges of the Tomcat process user. It is important to upgrade to the latest version of Tomcat or apply the recommended workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications.
This vulnerability allows a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This could lead to unauthorized access, data manipulation, or other malicious activities.
Versions 8.5.55 to 8.5.73, 9.0.35 to 9.0.56, and 10.0.0-M5 to 10.0.14, as well as 10.1.0-M1 to 10.1.0-M8 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the latest version of Apache Tomcat. The fix is included in versions 8.5.73, 9.0.56, and 10.0.14. Users should update their Tomcat installations to one of these versions or later.
Yes, if upgrading to the latest version is not immediately possible, a workaround is to disable session persistence using the FileStore. This can be done by modifying the Tomcat configuration to use a different session persistence mechanism, such as a database or an in-memory store.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
