CVE-2024-50379: Apache Tomcat Time-of-Check Time-of-Use Race Condition Vulnerability
Summary
CVE-2024-50379: Apache Tomcat: RCE due to TOCTOU issue in JSP compilation. Affects tomcat across 3 version ranges.
>= 9.0.0, < 9.0.98
>= 10.1.0, < 10.1.34
>= 11.0.0, < 11.0.9
Fixed in 9.0.98, 10.1.34 or 11.0.9, depending on the release line you run. How to fix ↓
Also tracked for
- org.apache.tomcat:tomcat-catalina · Maven
- tomcat10 · Debian:12
The same CVE-2024-50379 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java web applications. The package is known for its flexibility, scalability, and support for various Java standards. However, it is susceptible to vulnerabilities that can lead to severe security risks, such as remote code execution (RCE).
Vulnerability Detail
The vulnerability identified as CVE-2024-50379 is a Time-of-Check Time-of-Use (TOCTOU) race condition that occurs during JSP compilation in Apache Tomcat. This issue arises when the default servlet is enabled for write operations on case-insensitive file systems. An attacker could exploit this vulnerability to execute arbitrary code on the server, leading to potential data breaches or system compromise. The affected versions include Apache Tomcat from 11.0.0-M1 to 11.0.1, 10.1.0-M1 to 10.1.33, and 9.0.0.M1 to 9.0.97.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.0.989.0.98 -
>= 10.1.0, < 10.1.3410.1.34 -
>= 11.0.0, < 11.0.911.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the default servlet's write permissions or switch to a case-sensitive file system to mitigate the risk until an upgrade can be performed.
Conclusion
The CVE-2024-50379 vulnerability in Apache Tomcat poses a significant risk due to its potential for remote code execution. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk. Temporary workarounds can be employed until an upgrade is feasible.
See every vulnerability recorded for tomcat →
FAQ
CVE-2024-50379 is a vulnerability in Apache Tomcat that allows for remote code execution due to a race condition during JSP compilation.
The affected versions include Apache Tomcat from 11.0.0-M1 to 11.0.1, 10.1.0-M1 to 10.1.33, and 9.0.0.M1 to 9.0.97.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor and alert for vulnerabilities.
Exploiting this vulnerability could allow an attacker to execute arbitrary code on the server, potentially leading to data breaches and system compromise.
If immediate upgrading is not possible, consider disabling write permissions for the default servlet or switching to a case-sensitive file system as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
