CVE-2024-56337

Deeper analysis

CVE-2024-56337 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat that stems from an incomplete fix for the related CVE-2024-50379. It affects Tomcat versions 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97, as well as end-of-life releases from 8.5.0 through 8.5.100. The flaw manifests when Tomcat runs on a case-insensitive file system with the default servlet configured for write access by setting the readonly initialization parameter to false.

Remote attackers without authentication can exploit the race condition to achieve arbitrary file writes or other impacts that lead to full confidentiality, integrity, and availability compromise, reflected in the CVSS 9.8 score. Exploitation requires specific environmental conditions around file-system case sensitivity and servlet write permissions, but no user interaction is needed once those are met.

Advisories recommend upgrading to Tomcat 11.0.3, 10.1.35, or 9.0.99 and later, which add runtime checks for the sun.io.useCanonCaches system property and set it to false by default where possible. On Java 8 or 11, the property must be explicitly disabled; on Java 17 it must remain unset or false; and on Java 21 and newer no additional action is required because the problematic cache was removed.

The EPSS score rose from a low baseline to a peak of 0.4819 before receding to the current value of 0.1286, indicating increased exploitation interest after disclosure.