Concurrent WebSocket Message Handling Vulnerability in Tomcat 9
Summary
CVE-2022-25762: If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application wil... Affects tomcat9 across 2 version ranges.
< 9.0.22-1
>= e37b977db6f47e4380ad67114a49e8568951c953, < 67928399251771271d95a1805001ba00e650adce
Fixed in 9.0.22-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications. Tomcat 9, in particular, introduced several enhancements over its predecessors, including improved performance and support for the latest Java standards. However, it is susceptible to a vulnerability that arises when WebSocket messages are sent while the connection is closing, potentially leading to data integrity issues.
Vulnerability Detail
The vulnerability, identified as CVE-2022-25762, occurs when a web application sends a WebSocket message concurrently with the closing of the WebSocket connection on Apache Tomcat versions 8.5.0 to 8.5.75 and 9.0.0.M1 to 9.0.20. This situation can lead to the application continuing to use a socket after it has been closed, resulting in error handling that may cause a pooled object to be placed in the pool twice. The implications include data being returned to the wrong user and other operational errors, which can severely affect the application's reliability and security.
How To Fix
Minimum fixed version
9.0.22-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tomcat9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement logic in your application to ensure that no WebSocket messages are sent during the closing phase of the connection. This can be achieved by adding checks in your WebSocket handling code to prevent message dispatching when the connection is in the process of closing.
Conclusion
CVE-2022-25762 is a significant vulnerability in Apache Tomcat that can lead to serious data integrity issues if not addressed. Users are strongly advised to upgrade to the latest version of Tomcat to mitigate the risks associated with this vulnerability. Implementing the recommended fixes and workarounds will help ensure the security and reliability of your applications.
See every vulnerability recorded for tomcat9 →
FAQ
CVE-2022-25762 is a vulnerability in Apache Tomcat that allows for concurrent WebSocket message handling during connection closure, potentially leading to data integrity issues.
The vulnerability affects Apache Tomcat versions 8.5.0 to 8.5.75 and 9.0.0.M1 to 9.0.20.
The risks include data being returned to the wrong user and other operational errors, which can compromise the application's reliability and security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2022-25762 is 8.6, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat9.
