Apache Tomcat Remote Code Execution Vulnerability Report

This document is a technical report addressing a vulnerability identified in Apache Tomcat, specifically CVE-2024-56337. This vulnerability allows attackers to execute remote code on affected systems by bypassing an incomplete mitigation for a previously recognized remote code execution (RCE) vulnerability, CVE-2024-50379. The report details that CVE-2024-56337 is a time-of-check time-of-use (TOCTOU) race condition vulnerability affecting systems running Apache Tomcat with the default servlet write enabled on case-insensitive file systems. It lists the affected versions of Apache Tomcat and recommends immediate patching to the latest versions. The report also outlines configuration adjustments for Java properties based on the version in use. Additionally, it identifies potential tactics, techniques, and procedures (TTPs) that could be exploited, including initial access and privilege escalation methods. The document notes that there are currently no known indicators of compromise (IoCs) associated with this vulnerability and emphasizes the importance of monitoring and response strategies for organizations relying on Java-based web applications.