CVE-2024-52316

Unchecked Error Condition (CWE-391)

Published: Nov 18, 2024 / Updated: 1d ago

GitHub Security Advisory: GHSA-xcpr-7mr4-h4xq Release Date: 2024-11-18 Update Date: 2024-11-18 Severity: Critical CVE-2024-52316 Base Score: 9.8 Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Package Information Package: org.apache.tomcat:tomcat-catalina Affected Versions: Patched Versions: 9.0.96 Description Unchecked Error Condition vulnerability in Apache Tomcat.

Currently trending CVE - hypeScore: 3 - Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indic

Preface: Apache Tomcat is one of the top technologies in Java developers’ tech stacks—and for good reason. According to the 2024 Java Developer Productivity Report, 36% of Java developers use Apache Tomcat as their application server. Background: Apache Tomcat (called “Tomcat” for short) is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies. Jakarta is one of their project under which they have developed tomcat servlet container. Jakarta Authentication defines a general low-level SPI for authentication mechanisms, which are controllers that interact with a caller and a container’s environment to obtain the caller’s credentials, validate these, and pass an authenticated identity (such as name and groups) to the container. Vulnerability details: Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process.

By manipulating with an unknown input, a remote code execution vulnerability can be exploited. It is rated critical.

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from …

These vulnerabilities, ranging from authentication bypass to potential cross-site scripting (XSS) attacks, could leave numerous web applications exposed to malicious actors. The advisory describes the issue: “ If Tomcat was configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not have failed, allowing the user to bypass the authentication process.