Summary

OEM	Apache
Severity	Critical
CVSS	9.8
CVEs	CVE-2024-50379, CVE-2024-54677
Exploited in Wild	Yes
Patch/Remediation Available	Yes
Advisory Version	1.0

Overview

Recent vulnerabilities in Apache Tomcat, identified as CVE-2024-50379 and CVE-2024-54677, present significant security threats, including remote code execution (RCE) and denial-of-service (DoS) risks. CVE-2024-50379 exploits a race condition during JSP compilation on case-insensitive file systems, enabling attackers to run arbitrary code. CVE-2024-54677 takes advantage of unlimited file uploads in example applications to trigger resource exhaustion.

Vulnerability Name	CVE ID	Product Affected	Severity	Affected Version
Race Condition Vulnerability	CVE-2024-50379	Apache	Critical	Apache Tomcat 11.0.0-M1 to 11.0.1 Apache Tomcat 10.1.0-M1 to 10.1.33 Apache Tomcat 9.0.0.M1 to 9.0.97
Uncontrolled Resource Consumption Vulnerability	CVE-2024-54677	Apache	Medium	Apache Tomcat 11.0.0-M1 to 11.0.1 Apache Tomcat 10.1.0-M1 to 10.1.33 Apache Tomcat 9.0.0.M1 to 9.0.97

Technical Summary

CVE ID	System Affected	Vulnerability Details	Impact
CVE-2024-50379	Apache Tomcat	A race condition during JSP compilation in Apache Tomcat allows attackers to upload malicious JSP files, leading to remote code execution. This occurs when the default servlet is configured with write permissions on a case-insensitive file system.	Remote Code Execution
CVE-2024-54677	Apache Tomcat	The examples web application in Apache Tomcat does not limit the size of uploaded data, enabling attackers to cause an OutOfMemoryError by uploading excessive amounts of data, leading to a denial of service.	Denial of Service

Remediation:

• Upgrade Apache Tomcat to the latest fixed versions:
  • Apache Tomcat 11.0.2 or latest
  • Apache Tomcat 10.1.34 or latest
  • Apache Tomcat 9.0.98 or latest

Recommendations:

• Configuration Hardening:
  • Restrict write permissions for the default servlet to prevent unauthorized JSP file uploads.
  • Remove or disable example applications to reduce exposure to potential attacks.
• Monitor and Audit:
  • Regularly review server logs for signs of exploitation attempts.
  • Apply a robust file upload policy to limit sizes and validate content.
• Regularly update all your software’s to address security vulnerabilities 

References:

• https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
• https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n
• https://tomcat.apache.org/security