Apache Tomcat: Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-2024-50379) #shorts

CVE

This recent vulnerability involves a Time-of-check Time-of-use, or TOCTOU, race condition in Apache Tomcat during JSP compilation. It occurs in a non-default setup where the default servlet has write permissions on case insensitive file systems. This condition enables remote code execution, posing a significant risk to Apache Tomcat installations, specifically from versions 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97. While the exact tools or attack profiles are not fully documented, this vulnerability makes affected systems susceptible to unauthorized remote access and potentially severe exploits.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r