CVE-2020-9484 Potential remote code execution in Apache Tomcat
Attackers can achieve remote code execution in Apache Tomcat by exploiting unsafe deserialization in the PersistenceManager when specific file control and configuration conditions are met.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-9484?
CVE-2020-9484 is a high-severity unsafe deserialization vulnerability in Apache Tomcat, published on 20 May 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
Weakness: CWE-502
Which versions are affected by CVE-2020-9484?
17 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat-catalina. It affects 26 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.0.0-M1 | 10.0.0-M5 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.0.0-M1 | 10.0.0-M5 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 | 7.0.104 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 | 7.0.104 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.0.0 | 8.5.55 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.0.0 | 8.5.55 |
11 more packages
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0 | 9.0.35 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0 | 9.0.35 |
tomcat Bitnami | From 7.0.0 | 7.0.108, 8.5.63, 9.0.43 |
org.apache.tomcat:tomcat-catalina Maven | From 10.0.0-M1 | 10.0.0-M5 |
org.apache.tomcat:tomcat-catalina Maven | From 10.0.0-M1 | 10.0.0-M5 |
org.apache.tomcat:tomcat-catalina Maven | From 7.0.0 | 7.0.104 |
org.apache.tomcat:tomcat-catalina Maven | From 7.0.0 | 7.0.104 |
org.apache.tomcat:tomcat-catalina Maven | From 8.0.0 | 8.5.55 |
org.apache.tomcat:tomcat-catalina Maven | From 8.0.0 | 8.5.55 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0 | 9.0.35 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0 | 9.0.35 |
Linux distribution packages (23)
tomcat6 Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-115.el6_10 |
tomcat6-admin-webapps Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-115.el6_10 |
tomcat6-docs-webapp Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-115.el6_10 |
tomcat6-el-2.1-api Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-115.el6_10 |
tomcat6-javadoc Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-115.el6_10 |
tomcat6-jsp-2.1-api Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-115.el6_10 |
tomcat6-lib Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-115.el6_10 |
tomcat6-servlet-2.5-api Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-115.el6_10 |
tomcat6-webapps Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-115.el6_10 |
tomcat6 Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-115.el6_10 |
tomcat6-admin-webapps Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-115.el6_10 |
tomcat6-docs-webapp Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-115.el6_10 |
tomcat6-el-2.1-api Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-115.el6_10 |
tomcat6-javadoc Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-115.el6_10 |
tomcat6-jsp-2.1-api Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-115.el6_10 |
tomcat6-lib Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-115.el6_10 |
tomcat6-servlet-2.5-api Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-115.el6_10 |
tomcat6-webapps Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-115.el6_10 |
tomcat6 Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-115.el6_10 |
tomcat6-admin-webapps Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-115.el6_10 |
tomcat6-docs-webapp Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-115.el6_10 |
tomcat6-el-2.1-api Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-115.el6_10 |
tomcat6-javadoc Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-115.el6_10 |
Products include Apache Tomcat, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Mcafee Epolicy Orchestrator, Opensuse Leap and 20 more.
How do I fix CVE-2020-9484?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.0.0-M5, 7.0.104, 8.5.55 or 9.0.35.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-9484 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-9484 exists.
Public exploit code: 1 Nuclei template and 17 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2020-9484, DEBIAN-CVE-2020-9484, DLA-2217-1, GHSA-344f-f5vg-2jfj, MGASA-2020-0277, RHSA-2020:2483 and 8 more.