Deserialization of Untrusted Data in Apache Tomcat - CVE-2020-9484

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28158

Deserialization of Untrusted Data in Apache Tomcat - CVE-2020-9484

Published: May 21, 2020 / Updated: September 27, 2024


Vulnerability identifier: #VU28158
CSH Severity: High
CVSS v4 BT: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]
CVE-ID: CVE-2020-9484
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in uploaded files names. A remote attacker can pass specially crafted file name to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that the server is configured to use PersistenceManager with a FileStore and the attacker knows relative file path from storage location.


Affected software

Apache Tomcat
JBoss Web Server
Amazon Linux AMI
Debian Linux
Gentoo Linux
Arch Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Web Scripting
Opensuse
openEuler
Fedora
Dell Support Assist Enterprise
Oracle Transportation Management
Oracle Retail Order Broker
Oracle Hospitality Guest Access
Oracle Communications Element Manager
Oracle Communications Session Route Manager
Oracle Managed File Transfer
Dell Secure Connect Gateway
Oracle Communications Diameter Signaling Router (DSR)
Oracle Communications Session Report Manager
SecureTransport
Oracle Communications Instant Messaging Server
Instantis EnterpriseTrack
Siebel UI Framework
libtomcat9-java (Ubuntu package)
tomcat9-docs (Ubuntu package)
tomcat9 (Ubuntu package)
libtomcat8-java (Ubuntu package)
tomcat8 (Ubuntu package)
tomcat8-docs (Ubuntu package)
tomcat7 (Ubuntu package)
libtomcat7-java (Ubuntu package)
libservlet3.0-java (Ubuntu package)
tomcat6 (Red Hat package)
tomcat6-webapps
tomcat6-servlet-2_5-api
tomcat6-lib
tomcat6-jsp-2_1-api
tomcat6
tomcat6-admin-webapps
tomcat6-docs-webapp
tomcat6-javadoc
tomcat (Red Hat package)
tomcat-webapps
tomcat
tomcat-servlet-3_1-api
tomcat-lib
tomcat-jsp-2_3-api
tomcat-javadoc
tomcat-el-3_0-api
tomcat-docs-webapp
tomcat-admin-webapps
tomcat-help
tomcat-jsvc
libtomcat9-embed-java (Ubuntu package)
tomcat9-common (Ubuntu package)
tomcat9 (Debian package)
tomcat-servlet-4_0-api
tomcat9

How to mitigate CVE-2020-9484

Install updates from vendor's website.

Apache Tomcat - addressed in versions 7.0.104, 8.5.55, 9.0.35, 10.0.0-M5
Dell Support Assist Enterprise - update to 4.00.06.00
Dell Secure Connect Gateway - update to 5.14.00.10
SecureTransport - update to 5.5-20220224
libtomcat9-java (Ubuntu package) - addressed in versions Ubuntu Pro, 9.0.16-3ubuntu0.18.04.2, 9.0.31-1ubuntu0.1, 9.0.31-1ubuntu0.2, 9.0.31-1ubuntu0.6
tomcat9-docs (Ubuntu package) - addressed in versions Ubuntu Pro, 9.0.31-1ubuntu0.6
tomcat9 (Ubuntu package) - addressed in versions Ubuntu Pro, 9.0.16-3ubuntu0.18.04.2, 9.0.31-1ubuntu0.1, 9.0.31-1ubuntu0.2, 9.0.31-1ubuntu0.6
libtomcat8-java (Ubuntu package) - addressed in versions Ubuntu Pro, 8.0.32-1ubuntu1.13
tomcat8 (Ubuntu package) - addressed in versions Ubuntu Pro, 8.0.32-1ubuntu1.13
tomcat8-docs (Ubuntu package) - update to Ubuntu Pro
tomcat7 (Ubuntu package) - update to Ubuntu Pro
libtomcat7-java (Ubuntu package) - update to Ubuntu Pro
libservlet3.0-java (Ubuntu package) - update to Ubuntu Pro
JBoss Web Server - update to 5.5.0
tomcat6 (Red Hat package) - update to 6.0.24-115.el6_10
tomcat6-webapps - update to 6.0.53-0.57.19.1
tomcat6-servlet-2_5-api - update to 6.0.53-0.57.19.1
tomcat6-lib - update to 6.0.53-0.57.19.1
tomcat6-jsp-2_1-api - update to 6.0.53-0.57.19.1
tomcat6 - update to 6.0.53-0.57.19.1
tomcat6-admin-webapps - update to 6.0.53-0.57.19.1
tomcat6-docs-webapp - update to 6.0.53-0.57.19.1
tomcat6-javadoc - update to 6.0.53-0.57.19.1
tomcat (Red Hat package) - update to 7.0.76-12.el7_8
tomcat-webapps - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat-servlet-3_1-api - update to 8.0.53-29.46.1
tomcat-lib - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat-jsp-2_3-api - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat-javadoc - addressed in versions 8.0.53-29.46.1, 9.0.36-3.64.1
tomcat-el-3_0-api - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat-docs-webapp - addressed in versions 8.0.53-29.46.1, 9.0.36-3.64.1
tomcat-admin-webapps - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat - addressed in versions 9.0.10-18, 9.0.10-25, 9.0.10-26
tomcat-help - addressed in versions 9.0.10-18, 9.0.10-25, 9.0.10-26
tomcat-jsvc - addressed in versions 9.0.10-18, 9.0.10-25, 9.0.10-26
libtomcat9-embed-java (Ubuntu package) - addressed in versions 9.0.16-3ubuntu0.18.04.2, 9.0.31-1ubuntu0.1, 9.0.31-1ubuntu0.2
tomcat9-common (Ubuntu package) - addressed in versions 9.0.16-3ubuntu0.18.04.2, 9.0.31-1ubuntu0.1, 9.0.31-1ubuntu0.2
tomcat9 (Debian package) - addressed in versions 9.0.31-1~deb10u2, 9.0.43-2~deb11u4
tomcat - addressed in versions 9.0.36-1.fc31, 9.0.36-1.fc32
tomcat-servlet-4_0-api - addressed in versions 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat9 - update to 9.0.64-1

External References

Related Security Bulletins