Overview
Apache Tomcat is an open-source web server and servlet container developed by the Apache Software Foundation. It implements several Java Enterprise Edition (Java EE) specifications including Java Servlet, JavaServer Pages (JSP), and WebSocket, allowing it to run Java web applications. Tomcat is widely used in both development and production environments due to its lightweight nature, ease of configuration, and compatibility with various Java applications.
An Authentication Bypass vulnerability (CVE-2024-52316) has been identified in Apache Tomcat through which an attacker may be able to bypass the authentication process.
Authorization Bypass vulnerabilities occur when a system fails to properly enforce access controls, allowing an attacker to gain access to resources or perform actions that they should not be authorized to.
This issue affects multiple versions of Apache Tomcat below 11.0.1.
Details
Module Info
- Product: Apache Tomcat
- Affected packages: tomcat-catalina
- Affected versions: >=9.0.0.M1 <9.0.96, >=10.1.0-M1 <10.1.31, >=11.0.0-M1 <11.0.0
- GitHub repository: https://github.com/apache/tomcat
- Published packages: https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-catalina
- Package manager: Maven
- Fixed in: 9.0.96, 10.1.31, and 11.0.0
Vulnerability Info
This vulnerability is triggered when the server uses custom Tomcat Jakarta Authentication and the ServerAuthContext component throws an exception during authentication. When this occurs, no HTTP status code is set to indicate failure and authentication does not fail as it should. Such behavior can lead to authentication bypass if the exception is not handled correctly. However, the Apache Tomcat Security Team has noted that no known Jakarta Authentication components exhibit this behavior.
Mitigation
Only recent versions of Apache Tomcat are community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade to a patched version of Apache Tomcat.
Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credit
- Tomcat security team
