CVE–: Critical RCE in Apache Tomcat

A high-severity vulnerability has been identified in Apache Tomcat, a widely-used open-source application server. This flaw could allow attackers to bypass security mechanisms, potentially leading to arbitrary code execution.

💡 Why it matters:

Exploiting this vulnerability could result in:

• ☠️ Unauthorized access to sensitive data.
• ☠️ Complete system compromise.
• ☠️ Deployment of malicious code or malware.

You Should Know:

1. Immediate Mitigation Steps

If you cannot upgrade immediately, apply these temporary fixes:

Disable Write Operations

Edit `conf/web.xml` and set the `readonly` parameter to `true` or comment it out:

<init-param>
<param-name>readonly</param-name>
<param-value>true</param-value>
</init-param>

Or disable it entirely:

<!-- <init-param>
<param-name>readonly</param-name>
<param-value>false</param-value>
</init-param> -->

Disable HTTP PUT Method

To prevent file upload exploits, modify `web.xml` to block PUT requests:

<init-param>
<param-name>allowPartialPut</param-name>
<param-value>false</param-value>
</init-param>

2. Upgrade Apache Tomcat

Always ensure you are running the latest patched version. Check your current version:

$CATALINA_HOME/bin/version.sh 
 or on Windows: 
%CATALINA_HOME%\bin\version.bat

Download the latest secure release from:

🔗 Apache Tomcat Official Downloads

3. Verify Security Configurations

Run these Linux commands to check for misconfigurations:

 Check if PUT method is enabled: 
grep -i "allowPartialPut" $CATALINA_HOME/conf/web.xml

Verify readonly flag: 
grep -i "readonly" $CATALINA_HOME/conf/web.xml

List running Tomcat instances: 
ps aux | grep tomcat 

4. Automate Patching with Scripts

Use this Bash script to apply mitigations automatically:

!/bin/bash 
TOMCAT_CONF="$CATALINA_HOME/conf/web.xml" 
BACKUP_FILE="$TOMCAT_CONF.bak"

Backup original config 
cp $TOMCAT_CONF $BACKUP_FILE

Disable PUT method 
sed -i 's/<param-name>allowPartialPut<\/param-name>.$/<param-name>allowPartialPut<\/param-name><param-value>false<\/param-value>/g' $TOMCAT_CONF

Enable readonly mode 
sed -i 's/<param-name>readonly<\/param-name>.$/<param-name>readonly<\/param-name><param-value>true<\/param-value>/g' $TOMCAT_CONF

Restart Tomcat 
systemctl restart tomcat 
echo "Mitigations applied. Tomcat restarted." 

5. Windows-Specific Commands

For Windows servers:

 Check Tomcat version: 
& "$env:CATALINA_HOME\bin\version.bat"

Restart Tomcat service: 
Restart-Service -Name "Tomcat9" 

What Undercode Say:

This vulnerability is critical and must be patched immediately. Attackers can exploit weak configurations to gain full control over servers. Always:
– Keep software updated.
– Disable unnecessary HTTP methods.
– Monitor logs for suspicious activities ($CATALINA_HOME/logs/catalina.out).
– Use firewalls to restrict access to Tomcat management interfaces.

Expected Output:

• ✅ Tomcat secured with readonly=true.
• ✅ PUT method disabled.
• ✅ System logs checked for exploitation attempts.
• ✅ Latest Tomcat version installed.

🔗 Reference: Apache Tomcat Security Advisory

References:

Reported By: Phuong Nguyen – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram