CVE-2024-50379: A Critical Race Condition in Apache Tomcat – Source: securityboulevard.com

Recently, an Apache Tomcat web server vulnerability, tracked as CVE-2024-50378, has been published, exposing the platform to remote code execution through a race condition failure.

What is CVE-2024-50379?

The CVE refers to a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that occurs during JSP (JavaServer Pages) compilation in Apache Tomcat. Under certain conditions, this flaw can lead to Remote Code Execution (RCE) on systems with case-insensitive file systems (e.g., Windows).

How does the vulnerability work

• Race Condition – Let’s start by understanding what a race condition is. It is a vulnerability that occurs when a system performs two or more operations in parallel, and the outcome depends on the timing or order of these operations. The issue arises because the time it takes the system to check a condition is not aligned with the time it takes to act on that condition, allowing an attacker or unexpected behavior to interfere with the process. In our case, When Tomcat checks if it’s safe to compile or use a JSP file (Time-of-Check), there’s a narrow window where an attacker can change or replace the file before it’s actually used (Time-of-Use).

• Case Insensitivity – This vulnerability is exploitable on case-insensitive file systems. On those kinds of systems, files with the same name but different CASE are treated identically, for example: “file.jsp” and “FILE.JSP”. 

An attacker could exploit this by quickly uploading a malicious JSP file with a different case after Tomcat checks for the file but before it compiles the JSP. If the default servlet is configured to allow write operations (which is not the default setup), this can lead to the compilation and execution of the malicious JSP., and results in a remote code execution.

It is essential to understand that two conditions must be true for your system to be vulnerable to that CVE:

1. The default servlet must be configured to allow write access, which is not a standard configuration and should not generally be allowed.
2. The system should be operated with a case-insensitive file system, otherwise, malicious files uploaded by the attacker won’t overwrite safe files.

Mitigations

• Upgrade: Upgrade to the suitable fix version released by Apache (9.0.98,  10.1.34, 11.0.2).

• Configuration Check: Unless absolutely necessary, ensure your Tomcat server does not have the default servlet configured for write access.

• Secure File Upload: Do not allow JSP files to be uploaded directly to directories served by the application.

Conclusion

CVE-2024-50379 highlights the importance of timely updates and careful configuration management when deploying servers. For any organization running Apache Tomcat, particularly in environments where case-insensitive file systems are in use, this vulnerability demands immediate attention to secure your infrastructure from potential exploits. Always keep your systems patched, and your configurations secure to mitigate risks like these.

*** This is a Security Bloggers Network syndicated blog from Mend authored by Lisa Haas. Read the original post at: https://www.mend.io/blog/cve-2024-50379-a-critical-race-condition-in-apache-tomcat/