Executive brief
Apache Tomcat is a widely used web server for hosting Java applications. A vulnerability exists that could allow an attacker to execute malicious code on the server if they can upload a file and the server is configured with specific session management settings. This could lead to a full system compromise, data theft, or service disruption.
Technical details
The vulnerability is a deserialization flaw occurring when Apache Tomcat is configured to use the PersistenceManager with a FileStore. If the PersistenceManager's sessionAttributeValueClassNameFilter is set to null (the default) or is overly permissive, an attacker can trigger remote code execution. Exploitation requires four conditions: the attacker must control a file's name and content on the server, the server must use FileStore, the session filter must be lax, and the attacker must know the relative path from the FileStore storage to their uploaded file. By sending a crafted request, the attacker forces Tomcat to deserialize the malicious file. Patches are available in versions 10.0.0-M5, 9.0.35, 8.5.55, and 7.0.104.
Affected products
- Apache Tomcat Catalina 7.0.0 to 7.0.103, 8.0.0 to 8.5.54, 9.0.0 to 9.0.34, 10.0.0-M1 to 10.0.0-M4
- Apache Tomcat Embed Core 7.0.0 to 7.0.103, 8.0.0 to 8.5.54, 9.0.0 to 9.0.34, 10.0.0-M1 to 10.0.0-M4
Timeline
- 2020-05-20: disclosed
- 2020-05-21: advisory