Deserialization of Untrusted Data in Apache Tomcat - CVE-2020-9484

Vulnerability identifier: #VU28158

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9484

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in uploaded files names. A remote attacker can pass specially crafted file name to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that the server is configured to use PersistenceManager with a FileStore and the attacker knows relative file path from storage location.

Apache Tomcat
JBoss Web Server
Amazon Linux AMI
Debian Linux
Gentoo Linux
Arch Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Web Scripting
Opensuse
openEuler
Fedora
Dell Support Assist Enterprise
Oracle Transportation Management
Oracle Retail Order Broker
Oracle Hospitality Guest Access
Oracle Communications Element Manager
Oracle Communications Session Route Manager
Oracle Managed File Transfer
Dell Secure Connect Gateway
Oracle Communications Diameter Signaling Router (DSR)
Oracle Communications Session Report Manager
SecureTransport
Oracle Communications Instant Messaging Server
Instantis EnterpriseTrack
Siebel UI Framework
libtomcat9-java (Ubuntu package)
tomcat9-docs (Ubuntu package)
tomcat9 (Ubuntu package)
libtomcat8-java (Ubuntu package)
tomcat8 (Ubuntu package)
tomcat8-docs (Ubuntu package)
tomcat7 (Ubuntu package)
libtomcat7-java (Ubuntu package)
libservlet3.0-java (Ubuntu package)
tomcat6 (Red Hat package)
tomcat6-webapps
tomcat6-servlet-2_5-api
tomcat6-lib
tomcat6-jsp-2_1-api
tomcat6
tomcat6-admin-webapps
tomcat6-docs-webapp
tomcat6-javadoc
tomcat (Red Hat package)
tomcat-webapps
tomcat
tomcat-servlet-3_1-api
tomcat-lib
tomcat-jsp-2_3-api
tomcat-javadoc
tomcat-el-3_0-api
tomcat-docs-webapp
tomcat-admin-webapps
tomcat-help
tomcat-jsvc
libtomcat9-embed-java (Ubuntu package)
tomcat9-common (Ubuntu package)
tomcat9 (Debian package)
tomcat-servlet-4_0-api
tomcat9

Install updates from vendor's website.

Apache Tomcat - addressed in versions 7.0.104, 8.5.55, 9.0.35, 10.0.0-M5
Dell Support Assist Enterprise - update to 4.00.06.00
Dell Secure Connect Gateway - update to 5.14.00.10
SecureTransport - update to 5.5-20220224
libtomcat9-java (Ubuntu package) - addressed in versions Ubuntu Pro, 9.0.16-3ubuntu0.18.04.2, 9.0.31-1ubuntu0.1, 9.0.31-1ubuntu0.2, 9.0.31-1ubuntu0.6
tomcat9-docs (Ubuntu package) - addressed in versions Ubuntu Pro, 9.0.31-1ubuntu0.6
tomcat9 (Ubuntu package) - addressed in versions Ubuntu Pro, 9.0.16-3ubuntu0.18.04.2, 9.0.31-1ubuntu0.1, 9.0.31-1ubuntu0.2, 9.0.31-1ubuntu0.6
libtomcat8-java (Ubuntu package) - addressed in versions Ubuntu Pro, 8.0.32-1ubuntu1.13
tomcat8 (Ubuntu package) - addressed in versions Ubuntu Pro, 8.0.32-1ubuntu1.13
tomcat8-docs (Ubuntu package) - update to Ubuntu Pro
tomcat7 (Ubuntu package) - update to Ubuntu Pro
libtomcat7-java (Ubuntu package) - update to Ubuntu Pro
libservlet3.0-java (Ubuntu package) - update to Ubuntu Pro
JBoss Web Server - update to 5.5.0
tomcat6 (Red Hat package) - update to 6.0.24-115.el6_10
tomcat6-webapps - update to 6.0.53-0.57.19.1
tomcat6-servlet-2_5-api - update to 6.0.53-0.57.19.1
tomcat6-lib - update to 6.0.53-0.57.19.1
tomcat6-jsp-2_1-api - update to 6.0.53-0.57.19.1
tomcat6 - update to 6.0.53-0.57.19.1
tomcat6-admin-webapps - update to 6.0.53-0.57.19.1
tomcat6-docs-webapp - update to 6.0.53-0.57.19.1
tomcat6-javadoc - update to 6.0.53-0.57.19.1
tomcat (Red Hat package) - update to 7.0.76-12.el7_8
tomcat-webapps - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat-servlet-3_1-api - update to 8.0.53-29.46.1
tomcat-lib - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat-jsp-2_3-api - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat-javadoc - addressed in versions 8.0.53-29.46.1, 9.0.36-3.64.1
tomcat-el-3_0-api - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat-docs-webapp - addressed in versions 8.0.53-29.46.1, 9.0.36-3.64.1
tomcat-admin-webapps - addressed in versions 8.0.53-29.46.1, 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat - addressed in versions 9.0.10-18, 9.0.10-25, 9.0.10-26
tomcat-help - addressed in versions 9.0.10-18, 9.0.10-25, 9.0.10-26
tomcat-jsvc - addressed in versions 9.0.10-18, 9.0.10-25, 9.0.10-26
libtomcat9-embed-java (Ubuntu package) - addressed in versions 9.0.16-3ubuntu0.18.04.2, 9.0.31-1ubuntu0.1, 9.0.31-1ubuntu0.2
tomcat9-common (Ubuntu package) - addressed in versions 9.0.16-3ubuntu0.18.04.2, 9.0.31-1ubuntu0.1, 9.0.31-1ubuntu0.2
tomcat9 (Debian package) - addressed in versions 9.0.31-1~deb10u2, 9.0.43-2~deb11u4
tomcat - addressed in versions 9.0.36-1.fc31, 9.0.36-1.fc32
tomcat-servlet-4_0-api - addressed in versions 9.0.36-3.24.1, 9.0.36-3.64.1, 9.0.36-3.79.1, 9.0.36-4.58.1
tomcat9 - update to 9.0.64-1

• Exploit #10542 - CVE-2020-9484 (Remake of CVE-2020-9484 by Pentestical) (September 27, 2024)
• Exploit #8861 - CVE-2020-9484_Exploit (Exploit for Apache Tomcat deserialization (CVE-2020-9484) which could lead to RCE) (February 21, 2023)
• Exploit #8604 - CVE-2020-9484_Exploit (Exploit for Apache Tomcat deserialization (CVE-2020-9484) which could lead to RCE) (November 14, 2022)
• Exploit #7344 - CVE-2020-9484 (POC - Apache Tomcat Deserialization Vulnerability (CVE-2020-9484)) (February 13, 2022)
• Exploit #7107 - CVE-2020-9484-Scanner (A smol bash script I threw together pretty quickly to scan for vulnerable versions of the Apache Tomcat RCE. I'll give it some love when I have the time. ) (December 7, 2021)
• Exploit #6952 - -CVE-2020-9484 (Apache Tomcat RCE (CVE-2020-9484)) (October 27, 2021)
• Exploit #5444 - CVE-2020-9484 (Apache Tomcat RCE (CVE-2020-9484)) (May 18, 2021)
• Exploit #5189 - CVE-2020-9484 () (March 1, 2021)
• Exploit #5142 - CVE-2020-9484 (POC for CVE-2020-9484) (February 11, 2021)
• Exploit #5089 - CVE-2020-9484-exploit () (January 28, 2021)
• Exploit #5088 - CVE-2020-9484 () (January 28, 2021)
• Exploit #5028 - -CVE-2020-9484 (Apache Tomcat RCE (CVE-2020-9484)) (January 18, 2021)
• Exploit #4984 - CVE-2020-9484 () (January 3, 2021)
• Exploit #3047 - CVE-2020-9484 (for Ubuntu 18.04, improve functions.) (June 19, 2020)
• Exploit #3023 - Deserialization of Untrusted Data (June 10, 2020)
• Exploit #3020 - CVE-2020-9484-Scanner (A smol bash script I threw together pretty quickly to scan for vulnerable versions of the Apache Tomcat RCE. I'll give it some love when I have the time. ) (June 10, 2020)
• Exploit #3017 - Apache Tomcat CVE-2020-9484 Proof Of Concept (June 4, 2020)
• Exploit #2993 - CVE-2020-9484 (用Kali 2.0复现Apache Tomcat Session反序列化代码执行漏洞) (June 3, 2020)
• Exploit #2988 - CVE-2020-9484 (利用ceye批量检测CVE-2020-9484) (June 3, 2020)
• Exploit #2983 - tomcat-cluster-session-sync-exp (tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包， 可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484是session持久化的洞，这个是session集群同步的洞！) (June 3, 2020)
• Exploit #2813 - CVE-2020-9484 () (June 3, 2020)

• https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E

• Remote code execution in Apache Tomcat
• OpenSUSE Linux update for tomcat
• Arch Linux update for tomcat8
• Arch Linux update for tomcat7
• Arch Linux update for tomcat9
• Arch Linux update for tomcat9
• Arch Linux update for tomcat7
• Arch Linux update for tomcat8
• Gentoo update for Apache Tomcat
• Amazon Linux AMI update for tomcat8
• Amazon Linux AMI update for tomcat7
• Multiple vulnerabilities in Instantis EnterpriseTrack
• Multiple vulnerabilities in Oracle Hospitality Guest Access
• Deserialization of Untrusted Data in Oracle Transportation Management
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router (DSR)
• Multiple vulnerabilities in Oracle Communications Session Route Manager
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Element Manager
• Deserialization of Untrusted Data in Oracle Managed File Transfer
• Multiple vulnerabilities in Oracle Retail Order Broker
• Deserialization of Untrusted Data in Siebel UI Framework
• Amazon Linux AMI update for tomcat8
• Amazon Linux AMI update for tomcat7
• Multiple vulnerabilities in Red Hat JBoss Web Server
• Multiple vulnerabilities in Oracle Communications Instant Messaging Server
• Amazon Linux AMI update for tomcat8
• Ubuntu update for tomcat9
• SUSE update for tomcat
• SUSE update for tomcat
• SUSE update for tomcat6
• Debian update for tomcat9
• Debian update for tomcat9
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Red Hat Enterprise Linux 6 update for tomcat6
• Red Hat Enterprise Linux 7 update for tomcat
• SUSE update for tomcat
• SUSE update for tomcat
• SUSE update for tomcat
• Axway SecureTransport update for Apache Tomcat (February 2022)
• openEuler 20.03 LTS SP1 update for tomcat
• openEuler update for tomcat
• openEuler 22.03 LTS update for tomcat
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Ubuntu update for tomcat7
• Ubuntu update for tomcat8
• Amazon Linux AMI update for tomcat9
• Ubuntu update for tomcat8
• Ubuntu update for tomcat9
• Fedora 31 update for tomcat
• Fedora 32 update for tomcat