Apache Tomcat Vulnerability Exposes Path Equivalence Risks

What changed

A significant vulnerability has been identified in Apache Tomcat, specifically related to path equivalence. This issue could allow attackers to execute remote code or gain unauthorized access to sensitive information.

The vulnerability arises from the handling of file names containing internal dots, which can lead to unintended consequences when files are uploaded through the Default Servlet.

Who is affected

Various versions of Apache Tomcat are impacted, making it crucial for users to assess their systems for vulnerability exposure.

The affected versions include: Apache Tomcat 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0.M1 to 9.0.98. Additionally, older versions such as 8.5.0 to 8.5.100 are also at risk.

• Users running Apache Tomcat versions 11.0.0-M1 through 11.0.2.
• Users of Apache Tomcat versions 10.1.0-M1 through 10.1.34.
• Users of Apache Tomcat versions 9.0.0.M1 through 9.0.98.
• Organizations still utilizing older, end-of-life versions of Apache Tomcat.

What to do

It is essential for affected users to take immediate action to mitigate the risks associated with this vulnerability. Upgrading to the latest stable version of Apache Tomcat is highly recommended.

In addition to upgrading, users should review their server configurations to ensure that write permissions are restricted and that security-sensitive files are adequately protected.

• Upgrade to the latest version of Apache Tomcat to close the vulnerability.
• Review and adjust server permissions to limit write access where possible.
• Implement security measures to protect sensitive files from unauthorized access.
• Monitor for unusual activity that may indicate exploitation attempts.