External risk intelligence

Apache Tomcat JSP Compilation TOCTOU Race Condition Leading to RCE

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-50379

Apache Tomcat is a widely deployed web server and application server commonly used to host public-facing web applications and APIs. While this specific vulnerability requires a non-default configuration where the default servlet is enabled for write, the product's role as a primary gateway for internet-accessible services makes public reachability a common deployment pattern.

Apache Tomcat

9.0.0 to before 9.0.9810.1.0 to before 10.1.3411.0.0 to before 11.0.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Apache Tomcat's JavaServer Pages compilation process could allow attackers to execute code remotely under specific, non-default configurations. This issue affects several versions of Tomcat, which is a widely used web application server. The main concern is confirming if your environment uses the affected configurations and is exposed.

Flaw allows code execution in Tomcat.
Affects web applications and public-facing services.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a Tomcat server that has specific configurations enabled. If the server is vulnerable, an attacker could leverage a race condition during Java Server Pages (JSP) compilation to achieve remote code execution. This could allow them to take control of the affected system.

An attacker needs network access.
A race condition during JSP compilation triggers it.
This can lead to full system compromise.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in Apache Tomcat could allow an attacker to execute arbitrary code on a server. This occurs due to a race condition during JavaServer Pages (JSP) compilation, which can be exploited when specific, non-default configurations related to the default servlet are enabled on case-insensitive file systems.

Server-side code execution.
Exploitation of race conditions in compilation.
System compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the nature of the vulnerability in Apache Tomcat, platform or infrastructure teams are likely responsible for its remediation, especially if Tomcat serves as a core component of the application environment. The initial practical step is to identify all Tomcat instances, determine their reachability and criticality, and then confirm the specific application or service owner accountable for the deployment. Planning for remediation should then proceed based on this confirmed ownership and assessed risk.

Identify accountable Tomcat owners.
Verify default servlet write access.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Tomcat?

Apache Tomcat is a widely used open-source web server and Jakarta Servlet container. It executes Java code, specifically JavaServer Pages (JSP) and servlets, to power dynamic web applications. It acts as the underlying engine that processes incoming web requests and generates the dynamic content users see in their browsers.

What is the vulnerability in CVE-2024-50379?

This vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition. It is classified as CWE-367. It occurs during the JSP compilation process, where a brief gap between checking a file and using it allows an attacker to manipulate the process. If successful, this flaw permits unauthorized remote code execution on the host system.

How can an attacker trigger this race condition?

The vulnerability requires specific, non-default conditions to trigger. It relies on a setup where the default servlet is explicitly enabled for write operations on a case-insensitive file system. Without this specific configuration where the server is permitted to write to its own files, the race condition does not occur, and the flaw cannot be exploited.

Is my instance relevant according to Halo Surface Signal?

Halo Surface Signal identifies Tomcat as a common gateway for internet-accessible services, increasing the likelihood of external reachability. If your application or API is public-facing, it is relevant to investigate. However, you must still verify if the specific non-default configuration regarding default servlet write access is active in your environment.

What are the first steps to secure my environment?

Start by identifying all running Tomcat instances and determining their specific configuration settings. Verify if the default servlet is configured for write access, as this is a required condition for the flaw. Coordinate with the application owners to plan an upgrade to the patched versions—11.0.2, 10.1.34, or 9.0.98—which resolve the race condition.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.