CVE-2020-9484: Apache Tomcat remote code execution via deserialization in PersistenceManager

CVE-2020-9484 · Severity: high · CVSS 7 · Published 2020-05-21

Apache Tomcat is a widely used web server for hosting Java applications. A vulnerability exists that could allow an attacker to execute malicious code on the server if they can upload a file and the server is configured with specific session management settings. This could lead to a full system compromise, data theft, or service disruption.

Technologies: org.apache.tomcat:tomcat-catalina (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2020-9484 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-9484 being exploited in the wild.
How severe is CVE-2020-9484?
High severity, with a CVSS score of 7, published 21 May 2020.
Which products and versions are affected?
Apache Software Foundation Tomcat Catalina 7.0.0 to 7.0.103, 8.0.0 to 8.5.54, 9.0.0 to 9.0.34, 10.0.0-M1 to 10.0.0-M4; org.apache.tomcat:tomcat-catalina (Maven) ECOSYSTEM:introduced=10.0.0-M1,fixed=10.0.0-M5; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=10.0.0-M1,fixed=10.0.0-M5.
Is there a fix for CVE-2020-9484?
Yes. org.apache.tomcat:tomcat-catalina (Maven): upgrade to 10.0.0-M5 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 10.0.0-M5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-9484 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2020-9484?
Check whether you run Apache Software Foundation Tomcat Catalina, org.apache.tomcat:tomcat-catalina (Maven) or org.apache.tomcat.embed:tomcat-embed-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat-catalina (Maven): upgrade to 10.0.0-M5 or later
    # set org.apache.tomcat:tomcat-catalina to 10.0.0-M5 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 10.0.0-M5 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 10.0.0-M5 in your pom.xml or build.gradle

Technical details

The vulnerability is a deserialization flaw occurring when Apache Tomcat is configured to use the PersistenceManager with a FileStore. If the PersistenceManager's sessionAttributeValueClassNameFilter is set to null (the default) or is overly permissive, an attacker can trigger remote code execution. Exploitation requires four conditions: the attacker must control a file's name and content on the server, the server must use FileStore, the session filter must be lax, and the attacker must know the relative path from the FileStore storage to their uploaded file. By sending a crafted request, the attacker forces Tomcat to deserialize the malicious file. Patches are available in versions 10.0.0-M5, 9.0.35, 8.5.55, and 7.0.104.

Affected products

  • Apache Tomcat Catalina 7.0.0 to 7.0.103, 8.0.0 to 8.5.54, 9.0.0 to 9.0.34, 10.0.0-M1 to 10.0.0-M4
  • Apache Tomcat Embed Core 7.0.0 to 7.0.103, 8.0.0 to 8.5.54, 9.0.0 to 9.0.34, 10.0.0-M1 to 10.0.0-M4

Identifiers

  • CVE-2020-9484
  • GHSA-344f-f5vg-2jfj

Timeline

  • 2020-05-20: disclosed
  • 2020-05-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.