CVE-2024-56337

The vulnerability affects systems where Apache Tomcat runs on case-insensitive file systems and the default servlet has write mode enabled (initialization parameter 'readonly' set to 'false'). In such configurations, depending on the Java version, the system property 'sun.io.useCanonCaches' can cause incorrect caching of canonical file paths, opening a race condition window between access verification and actual resource use. An attacker can substitute a malicious resource within this time window and bypass access control mechanisms. The mitigation applied for CVE-2024-50379 proved insufficient without additional JVM property configuration.

Successful exploitation of the vulnerability may enable an attacker to achieve remote code execution (RCE) or unauthorized file writing on the server, leading to complete system takeover, data confidentiality and integrity breaches, and loss of service availability.

Apache Tomcat should be updated to version 11.0.3, 10.1.35, 9.0.99 or later, which contain appropriate configuration verification mechanisms. Until the update is applied, additional version-dependent Java configuration is required: on Java 8 and Java 11, the system property 'sun.io.useCanonCaches=false' must be explicitly set (default is 'true'); on Java 17, ensure this property is set to 'false' or left at the default value ('false'); on Java 21 and later, no additional configuration is required. Alternatively, if write mode is not required, leave the 'readonly' parameter at its default value ('true').

Apache Tomcat in versions: 11.0.0-M1 to 11.0.1, 10.1.0-M1 to 10.1.33, 9.0.0.M1 to 9.0.97, and 8.5.0 to 8.5.100 (EOL versions). The vulnerability affects only installations running on case-insensitive file systems with write mode enabled for the default servlet. NetApp Bootstrap OS and NetApp HCI Compute Node products are also affected.