CVE-2020-9484: remote code execution vulnerability in org.apache.tomcat:tomcat-catalina

What is CVE-2020-9484 About?

This vulnerability allows for remote code execution via deserialization in Apache Tomcat under very specific conditions. If an attacker can control a file on the server and several configurations are met, they can exploit a crafted request to execute arbitrary code. Exploiting this is complex due to multiple prerequisites that must align.

Affected Software

org.apache.tomcat:tomcat-catalina
- >10.0.0-M1, <10.0.0-M5
- >8.0.0, <8.5.55
- >9.0.0, <9.0.35
- >7.0.0, <7.0.104

Technical Details

The vulnerability occurs when Apache Tomcat, in versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, and 7.0.0 to 7.0.103, is configured to use PersistenceManager with a FileStore and a 'sessionAttributeValueClassNameFilter' set to 'null' or a lax filter. An attacker must first be able to control the contents and name of a file on the server. Additionally, they need to know the relative file path from the FileStore's storage location to their controlled file. With these conditions met, a specially crafted request can trigger deserialization of the attacker-controlled file, leading to remote code execution.

What is the Impact of CVE-2020-9484?

Successful exploitation may allow attackers to execute arbitrary code on the server, leading to full system compromise, data theft, or denial of service.

What is the Exploitability of CVE-2020-9484?

Exploitation of this vulnerability is considered highly complex due to the numerous prerequisites. An attacker needs specific write access to the server to control file contents and names. The server must be configured with PersistenceManager and FileStore, and crucially, 'sessionAttributeValueClassNameFilter' must be null or sufficiently lax, which is not always the default if a SecurityManager is used. Authentication might be required for file upload, but the code execution itself may not require specific authentication beyond sending the crafted request. Local access to plant the file, or a separate remote code execution vulnerability for remote file planting, would increase the likelihood of exploitation. Remote access is possible, but relies on a preceding condition of placing a malicious file on the server. Knowledge of the specific file path is also a critical constraint.

What are the Known Public Exploits?

PoC Author	Link	Commentary
threedr3am	Link	tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包，可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484是session持久化的洞，这个是session集群同步的洞！
masahiro331	Link	PoC for CVE-2020-9484
IdealDreamLast	Link	用Kali 2.0复现Apache Tomcat Session反序列化代码执行漏洞

What are the Available Fixes for CVE-2020-9484?

Available Upgrade Options

org.apache.tomcat:tomcat-catalina
- >7.0.0, <7.0.104 → Upgrade to 7.0.104
org.apache.tomcat:tomcat-catalina
- >8.0.0, <8.5.55 → Upgrade to 8.5.55
org.apache.tomcat:tomcat-catalina
- >9.0.0, <9.0.35 → Upgrade to 9.0.35
org.apache.tomcat:tomcat-catalina
- >10.0.0-M1, <10.0.0-M5 → Upgrade to 10.0.0-M5

Struggling with dependency upgrades?

See how Resolved Security's drop-in replacements make it simple.

Book a demo

Additional Resources

What are Similar Vulnerabilities to CVE-2020-9484?

Similar Vulnerabilities: CVE-2017-9805 , CVE-2015-4852 , CVE-2019-2729 , CVE-2017-3241 , CVE-2016-0638

CVE-2020-9484 remote code execution vulnerability in org.apache.tomcat:tomcat-catalina