Apache Tomcat JSP Source Code Disclosure (CVE-2021-24122)
Summary
CVE-2021-24122: When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code discl... Affects tomcat9 across 40 version ranges.
< 3bd48aab236e5bf0ed1644e9f0c588fd20e503ab
>= 3c78e95e36268dfb76db1570f0cf49104fa6eabc, <= 6989c4e9360b4f9443862968c15a95d17f264321
< 6f143d19d151620cd0bfe9ec2ffa429e36ad0e45
< 7dc5e29fe49850102261badf158752d6865311e4
< 8c48678b110f3fbbe66f6dde0e45d2578fa92c29
< 9.0.40-1
< 9c5edb840d9413c1408e7c191bc0e1bbfcd9e07f
< 10e04de1946981261a734507f4a6d953e2a206fe
< 18b014d8691909be6153ae7db022a6c35f9c93ea
< 27f7ef8cd0c637b700d564ec20f6ff92901f6b5c
< 29b07def810d335012e738b22ab44d4e232b50d1
< 45f8fd74cdb96490fab8709263a4d862f0d429cf
< 59e713216cf2256aacc54f6ba627865f356f9e4e
< 65ddc3a3872ea41ca67fec7b6834c704b6893361
< 600dc8ba5d9be7599d29bff83c342213d93b034e
< 642d3dd4d50ea1f03f9827962e4fc982a123bb78
< 772df65db45cfccc2aad33b9b51ef9ab14c19626
< 24566c02fb917a6ca1b6479a60971b0d8acd895c
< 35071e7e52f296b9187b054b0efd74121b7db3bd
< aac670afe1226e10513021100fce8a12344743c6
< ab04166fac59fcf9b3be3aab1c8b896842782d4c
< aba238718ac9b149d25feaa9a14ecad3b0e3a5e2
< b0b074b683ed2e09ff9e9755825bfce83d303a93
< b3a208c6d6d01c553178c5e718e750b0eb318151
< b3f5e0d88336d81a61a767fc10ab06930c9587ee
< b5a74e3c7913c560648f0ffedfbbb3ebe4318def
< c2c8107f0cea4755497a85990807b883b66f6b57
< c5efed313de1a181f4f9f98f5023117f3b911257
< c7b84102600d600bcc527560d9c4d10c3fd440ab
< c549413165721180b15f62033c1be6c5970028fd
< cac0e029dcced854eeca7444710e78e412dc2c2a
< d1dc05e934e089ea8907998cf850760017a0ed82
< d8ebf61e51b4455e3c226751e492a533f9002d48
< d971ce1bdf8b8e8de93fb41454f4ce2e815ee936
< de128d72af746184e035ff1b53629f08cb141a04
>= e37b977db6f47e4380ad67114a49e8568951c953, <= c042ec71219dbde3e1ce0381ce5be0801120d0fa
>= e498667bd7811e846771a852b16ce9f1e524b81b, <= c5d9010a75e99a69f59ba11cc1116d039a113979
< eb684224706fe1d8ef5610c8d79dc403e1038393
< fd7f13635e6855f6ba3fead0bf37ba2fbf8b68cf
< fe854ab1f111396458d98fa2ab08c693ce9407e1
Fixed in 9.0.40-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The vulnerability identified as CVE-2021-24122 affects Apache Tomcat versions 7.0.0 to 7.0.106, 8.5.0 to 8.5.59, 9.0.0.M1 to 9.0.39, and 10.0.0-M1 to 10.0.0-M9. This vulnerability allows an attacker to disclose the source code of JSP files in certain configurations.
Vulnerability Detail
The vulnerability arises from the unexpected behavior of the JRE API File.getCanonicalPath(), which is caused by the inconsistent behavior of the Windows API (FindFirstFileW) in specific circumstances. By exploiting this vulnerability, an attacker can gain access to the source code of JSP files, potentially exposing sensitive information such as database credentials, API keys, and other confidential data. This can lead to further attacks, data breaches, and unauthorized access to the affected system.
How To Fix
Minimum fixed version
9.0.40-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tomcat9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by configuring Apache Tomcat to serve resources from a location other than the network location using the NTFS file system. By avoiding the use of the NTFS file system for serving resources, the vulnerability can be mitigated. However, this workaround may have implications on the overall functionality and performance of the system.
Conclusion
The Apache Tomcat JSP Source Code Disclosure vulnerability (CVE-2021-24122) can have serious implications for the security of web applications hosted on affected versions of Apache Tomcat. It is crucial to promptly upgrade to the latest version or apply the recommended workaround to mitigate the risk of source code disclosure and potential unauthorized access. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tomcat9 →
FAQ
Apache Tomcat is an open-source web server and servlet container that provides a platform for running Java-based web applications.
The vulnerability affects Apache Tomcat versions 7.0.0 to 7.0.106, 8.5.0 to 8.5.59, 9.0.0.M1 to 9.0.39, and 10.0.0-M1 to 10.0.0-M9.
This vulnerability allows an attacker to disclose the source code of JSP files, potentially exposing sensitive information and leading to further attacks and unauthorized access.
To fix this vulnerability, it is recommended to upgrade to Apache Tomcat version 7.0.107, 8.5.60, 9.0.40, or 10.0.0-M10, or later.
Yes, a temporary workaround is to configure Apache Tomcat to serve resources from a location other than the network location using the NTFS file system.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat9.
