CVE-2024-50379

The vulnerability results from a race condition occurring during JSP file compilation. An attacker can exploit the time window between the moment the file is checked (time-of-check) and the moment it is used (time-of-use) to substitute or manipulate a file on a case-insensitive file system. A successful attack requires the default servlet to be configured with write capability, which is not the default setting. Through clever file operations within this race condition window, it is possible to cause the server to execute code supplied by the attacker.

A successful attack allows an unauthenticated attacker to execute arbitrary code remotely (RCE) on the server, which may lead to complete system takeover, data disclosure, and compromise of service integrity and availability.

Update Apache Tomcat to version 11.0.2, 10.1.34, or 9.0.98, which contain the fix. If immediate updating is not possible, ensure that the default servlet does not have write support enabled (readonly=true parameter, which is the default configuration). Versions 8.5.x are EOL and will not receive an official patch — migration to a supported branch is recommended.

Apache Tomcat in versions: 11.0.0-M1 to 11.0.1, 10.1.0-M1 to 10.1.33, 9.0.0.M1 to 9.0.97. Version 8.5.0 to 8.5.100 (EOL) is also vulnerable. Older EOL versions may also be vulnerable. The vulnerability affects only case-insensitive file systems with write support enabled in the default servlet.