Tomcat vulnerability: Time-of-Check Time-of-Use (TOCTOU) Vulnerability Follow

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialization
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be
set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

There are two options to resolve the vulnerability:

1. Update tomcat server to the latest release and update Java version.

Mitigate the CVE-2024-50379 vulnerability in your current Tomcat version

To mitigate CVE-2024-50379 on Java 8, you need to disable canonicalization caching by setting the system property sun.io.useCanonCaches=false. Here’s how you can do it:

1. Modify the Tomcat Startup Script

You can add the system property to Tomcat’s startup script to ensure it is applied at runtime.

• For Linux/macOS (catalina.sh):

  1. Open the file:
     sh

      

     nano /path/to/tomcat/bin/catalina.sh
  2. Locate the JAVA_OPTS or CATALINA_OPTS section and add:
     sh

      

     JAVA_OPTS="$JAVA_OPTS -Dsun.io.useCanonCaches=false"
  3. Save and exit.
  4. Restart Tomcat:
     sh

      

     ./shutdown.sh && ./startup.sh

• For Windows (catalina.bat):

  1. Open the file:
     cmd

      

     notepad C:\path\to\tomcat\bin\catalina.bat
  2. Locate the set JAVA_OPTS section and add:
     cmd

      

     set JAVA_OPTS=%JAVA_OPTS% -Dsun.io.useCanonCaches=false
  3. Save and restart Tomcat:
     cmd

      

     shutdown.bat && startup.bat

2. Set in setenv.sh or setenv.bat (Recommended)

Instead of modifying catalina.sh or catalina.bat, you can create or modify a setenv.sh (Linux/macOS) or setenv.bat (Windows) in TOMCAT_HOME/bin/:

• Linux/macOS (setenv.sh)

  sh

   

  export JAVA_OPTS="$JAVA_OPTS -Dsun.io.useCanonCaches=false"

  Then restart Tomcat.

• Windows (setenv.bat)

  cmd

   

  set JAVA_OPTS=%JAVA_OPTS% -Dsun.io.useCanonCaches=false

  Then restart Tomcat.

3. Modify JAVA_OPTS in Environment Variables

You can set the property globally for Java 8:

• Linux/macOS:

  sh

   

  export JAVA_OPTS="$JAVA_OPTS -Dsun.io.useCanonCaches=false"

  Add it to ~/.bashrc or /etc/profile to persist.

• Windows:

  1. Open Control Panel → System → Advanced system settings.
  2. Click Environment Variables.
  3. Under System Variables, edit JAVA_OPTS and add:
     ini

      

     -Dsun.io.useCanonCaches=false
  4. Restart the system.