Impact of CVE-2024-50379, CVE-2024-56337 and CVE-2024-54677 affecting Tomcat Apache on eDiscovery Platform

Description

CVE-2024-50379: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat

https://nvd.nist.gov/vuln/detail/CVE-2024-50379

Affected Versions of Apache Tomcat used in eDiscovery Platform (versions listed below): 9.0.0.M1 through 9.0.97

Fix Versions of Apache Tomcat: 9.0.98 or later

Base Score: 9.8 CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The CVE-2024-50379 vulnerability permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.

Impact

eDiscovery Platform versions 10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.3 and 10.3.1 use Apache Tomcat Series 9.0.x, which are affected versions. The product is installed on a case insensitive file system as all versions of Windows Server OS are case insensitive. However, the default servlet in Tomcat is not configured to allow write operations. As the server is running as part of the Enterprise Security periphery which is guarded by Role Based Access where only a user with Administrator rights can perform a remote login to the server, and as long as only a trusted set of users have Administrative access to the eDiscovery Platform server, the chances of exploitation are none.

Mitigation

As the exploitation situation described in the CVE is not fulfilled, no mitigation is needed. Continue to ensure that only a trusted set of users have Administrative access to the server where eDiscovery Platform is hosted. Versions of Apache Tomcat not affected by this CVE will be included in eDiscovery Platform version 10.3.2 and higher (when available).

CVE-2024-56337: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat

https://nvd.nist.gov/vuln/detail/CVE-2024-56337

Affected Versions of Apache Tomcat used in eDiscovery Platform (versions listed below): 9.0.0.M1 through 9.0.97

Fix Versions of Apache Tomcat: 9.0.98 or later

Base Score: 9.8 CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The CVE-2024-56337 vulnerability affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

Impact

eDiscovery Platform versions 10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.3 and 10.3.1 use Apache Tomcat Series 9.0.x, which are affected versions. The product is installed on a case insensitive file system as all versions of Windows Server OS are case insensitive. However, the default servlet in Tomcat is not configured to allow write operations. As the server is running as part of the Enterprise Security periphery which is guarded by Role Based Access where only a user with Administrator rights can perform a remote login to the server, and as long as only a trusted set of users have Administrative access to the eDiscovery Platform server, the chances of exploitation are none.

Mitigation

As the exploitation situation described in the CVE is not fulfilled, no mitigation is needed. Continue to ensure that only a trusted set of users have Administrative access to the server where eDiscovery Platform is hosted. Versions of Apache Tomcat not affected by this CVE will be included in eDiscovery Platform version 10.3.2 and higher (when available).

CVE-2024-54677: Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat

https://nvd.nist.gov/vuln/detail/CVE-2024-54677

Affected Versions of Apache Tomcat used in eDiscovery Platform (versions listed below): 9.0.0.M1 through 9.0.97

Fix Versions of Apache Tomcat: 9.0.98 or later

Base Score: 5.3 MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

The CVE-2024-54677 vulnerability leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

Impact

eDiscovery Platform versions 10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.3 and 10.3.1 use Apache Tomcat Series 9.0.x, which are affected versions. The vulnerability arises because numerous examples in the web application do not impose limits on uploaded data. An attacker can exploit this by uploading excessively large files, causing the server to run out of memory and resulting in an OutOfMemoryError. As the server is running as part of the Enterprise Security periphery which is guarded by Role Based Access where only a user with Administrator rights can perform a remote login to the server, and as long as only a trusted set of users have Administrative access to the eDiscovery Platform server, the chances of exploitation are none.

Mitigation

As the exploitation situation described in the CVE is not fulfilled, no mitigation is needed. Continue to ensure that only a trusted set of users have Administrative access to the server where eDiscovery Platform is hosted. Versions of Apache Tomcat not affected by this CVE will be included in eDiscovery Platform version 10.3.2 and higher (when available).

Questions

For questions or problems regarding these vulnerabilities, please contact Technical Support (https://www.veritas.com/support) 

Disclaimer

THE SECURITY ADVISORY IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. VERITAS TECHNOLOGIES LLC AND/OR ARCTERA US LLC SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.