Authentication Bypass Vulnerability in Apache Tomcat 9.0 - CVE-2021-30640
Summary
CVE-2021-30640: A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. Affects tomcat9 across 2 version ranges.
< 9.0.43-2~deb11u1
>= e498667bd7811e846771a852b16ce9f1e524b81b, < 2cdef2c0241cdf70b5edd88d3733a52e6b675047
Fixed in 9.0.43-2~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The JNDI Realm in Tomcat allows for user authentication against a variety of data sources, but it has been found to be vulnerable to specific attack vectors that can compromise its security.
Vulnerability Detail
CVE-2021-30640 is a vulnerability in the JNDI Realm of Apache Tomcat that allows attackers to authenticate using variations of a valid username or bypass protections provided by the LockOut Realm. This vulnerability affects multiple versions of Tomcat, specifically from 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, and 8.5.0 to 8.5.65. The potential ramifications include unauthorized access to sensitive information and the ability to perform actions as legitimate users, thereby compromising the integrity of the application.
How To Fix
Minimum fixed version
9.0.43-2~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tomcat9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as IP whitelisting or using a more restrictive authentication mechanism until you can upgrade to a secure version of Tomcat.
Conclusion
CVE-2021-30640 represents a significant security risk for users of Apache Tomcat, particularly those using affected versions. It is crucial to upgrade to a secure version to mitigate the risk of unauthorized access and ensure the integrity of your applications.
See every vulnerability recorded for tomcat9 →
FAQ
CVE-2021-30640 is a vulnerability in the JNDI Realm of Apache Tomcat that allows attackers to bypass authentication mechanisms.
The vulnerability affects Apache Tomcat versions 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, and 8.5.0 to 8.5.65.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2021-30640 is 6.5, indicating a medium severity level.
If an immediate upgrade is not possible, consider implementing additional security measures such as IP whitelisting or using a more restrictive authentication mechanism.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat9.
