CVE-2024-21733: Apache Tomcat sensitive information disclosure in error messages

Executive brief

Apache Tomcat, a widely used web server for Java applications, is vulnerable to a flaw where it may reveal sensitive information in error messages. An attacker could potentially use this information to gain insights into the server's environment or internal data. Organizations should update to the latest versions to prevent this data exposure.

Technical details

Apache Tomcat is vulnerable to CWE-209 (Generation of Error Message Containing Sensitive Information). The vulnerability allows a remote, unauthenticated attacker to trigger error responses that include sensitive details about the server environment or associated data. This issue is related to how the Coyote HTTP connector handles certain request scenarios, potentially leading to information disclosure or HTTP response smuggling. The flaw is fixed in Apache Tomcat versions 8.5.64 and 9.0.44.

Affected products

• Apache Tomcat 8.5.7 to 8.5.63, 9.0.0-M11 to 9.0.43

Timeline

• 2024-01-19: disclosed
• 2024-01-19: advisory

References

• https://api.github.com/users/westonsteimel
• https://github.com/westonsteimel
• https://api.github.com/users/westonsteimel/gists%7B/gist_id%7D
• https://api.github.com/users/westonsteimel/repos
• https://avatars.githubusercontent.com/u/1593939?v=4
• https://api.github.com/users/westonsteimel/events%7B/privacy%7D