CVE-2024-50379: Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 31.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-17 · updated 2026-06-17
Weakness: CWE-367

Description

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

Summary

CVE-2024-50379 is a critical (CVSS 9.8) TOCTOU race condition in Apache Tomcat's JSP compilation that can allow remote code execution on case-insensitive file systems when the default servlet is enabled for write, a non-default configuration. It affects Tomcat 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97, plus EOL 8.5.0 through 8.5.100. A proof-of-concept exists and EPSS estimates a 31.8% chance of exploitation in 30 days, though it is not in CISA KEV. Upgrade to 11.0.2, 10.1.34, or 9.0.98; if you cannot patch, avoid enabling the default servlet for write on case-insensitive file systems.

CVE-2024-50379 ثغرة حرجة (CVSS 9.8) من نوع TOCTOU أثناء ترجمة JSP في Apache Tomcat، وقد تسمح بتنفيذ تعليمات برمجية عن بُعد على أنظمة الملفات غير الحساسة لحالة الأحرف عند تفعيل default servlet للكتابة، وهي إعدادات غير افتراضية. تؤثر في Tomcat 11.0.0-M1 حتى 11.0.1، و10.1.0-M1 حتى 10.1.33، و9.0.0.M1 حتى 9.0.97، إضافة إلى الإصدارات المنتهية الدعم 8.5.0 حتى 8.5.100. يتوفر إثبات مفهوم (PoC) وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 31.8%، مع أنها ليست في CISA KEV. يُنصح بالترقية إلى 11.0.2 أو 10.1.34 أو 9.0.98، وإن تعذّر الترقيع فتجنّب تفعيل default servlet للكتابة على أنظمة ملفات غير حساسة لحالة الأحرف.

Affected products

Apache Tomcat: from 9.0.0 before 9.0.98; from 10.1.0 before 10.1.34; from 11.0.0 before 11.0.2 — fixed in 10.1.34, 11.0.2, 9.0.98
NetApp Bootstrap Os: all versions

How to fix

Upgrade to a fixed version: Apache Tomcat 10.1.34, 11.0.2, 9.0.98. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-50379 or the next vulnerability affects your stack