Apache Tomcat Vulnerability CVE-2024-56337: Incomplete Mitigation Leads to Remote Code Execution Risks
On December 20, 2024, the Apache Software Foundation disclosed a significant security vulnerability in Apache Tomcat, identified as CVE-2024-56337. This vulnerability arises from an incomplete mitigation of a prior issue, CVE-2024-50379, and poses a risk of remote code execution (RCE) under specific conditions.
Understanding the Vulnerability
CVE-2024-56337 is classified as a Time-of-Check Time-of-Use (TOCTOU) race condition within Apache Tomcat. It affects the following versions:
- Apache Tomcat 11.0.0-M1 through 11.0.1
- Apache Tomcat 10.1.0-M1 through 10.1.33
- Apache Tomcat 9.0.0.M1 through 9.0.97
The vulnerability is particularly concerning for users operating Tomcat on case-insensitive file systems with the default servlet's write capability enabled (i.e., the 'readonly' initialization parameter set to 'false'). In such configurations, the incomplete fix for CVE-2024-50379 may allow attackers to exploit the TOCTOU race condition, potentially leading to remote code execution.
Mitigation Steps
To address CVE-2024-56337, users should upgrade to the following Apache Tomcat versions:
- Apache Tomcat 11.0.2 or later
- Apache Tomcat 10.1.34 or later
- Apache Tomcat 9.0.98 or later
Additionally, configuration adjustments are necessary based on the Java version in use:
- Java 8 or Java 11: Explicitly set the system property
sun.io.useCanonCachestofalse(default istrue). - Java 17: If the system property
sun.io.useCanonCachesis set, ensure it isfalse(default isfalse). - Java 21 and later: No additional configuration is required, as the system property and the associated cache have been removed.
Future releases—Tomcat 11.0.3, 10.1.35, and 9.0.99 onwards—will include checks to ensure sun.io.useCanonCaches is appropriately configured before enabling write capabilities for the default servlet on case-insensitive file systems. Tomcat will also set sun.io.useCanonCaches to false by default where possible.
Recommendations for Users
Users are strongly advised to:
- Upgrade to the latest compatible version of Apache Tomcat.
- Review and adjust the
sun.io.useCanonCachessystem property based on the Java version in use. - Ensure that the default servlet's write capability is disabled unless explicitly required.
- Regularly monitor official Apache Tomcat communications for updates and security advisories.
Conclusion
The disclosure of CVE-2024-56337 underscores the importance of comprehensive vulnerability mitigation and the need for vigilance in maintaining server configurations. By promptly applying the recommended updates and configurations, users can safeguard their systems against potential exploitation.