Critical security vulnerability discovered in Apache Tomcat – What you should do now

A serious security vulnerability in Apache Tomcat was recently discovered, which could allow attackers to execute arbitrary code on the server under certain conditions. This vulnerability affects multiple versions of the popular open-source servlet engine and requires immediate action from administrators and developers.

Affected Versions

The vulnerability affects the following Tomcat versions:

• Apache Tomcat 11.0.0-M1 to 11.0.2

• Apache Tomcat 10.1.0-M1 to 10.1.34

• Apache Tomcat 9.0.0.M1 to 9.0.98

Certain non-standard configurations could allow attackers to inject malicious code via specially crafted HTTP methods such as PUT.

Initial attack attempts already observed

Shortly after the vulnerability was disclosed, the first attack attempts were already recorded. Security researchers report attackers who are specifically scanning unpatched Tomcat instances and attempting to gain access. Publicly accessible servers that are inadequately secured are particularly vulnerable.

Recommended protective measures

To minimize the risk of a successful attack, the following measures should be implemented immediately:

1. Update: The latest patched version of Tomcat (11.0.3, 10.1.35, or 9.0.99) should be installed immediately.

2. Verify configuration: Administrators should ensure that write access to the default servlet is disabled and that PUT requests are only allowed when absolutely necessary.

3. Access restrictions: Network-level controls should be implemented to restrict access to the Tomcat server to trusted sources.

4. Set up monitoring: Server logs should be checked regularly, especially for unexpected PUT or POST requests that could indicate an exploit attempt.

Conclusion

This vulnerability once again demonstrates the importance of a proactive security strategy for web applications. Companies and administrators should act immediately to protect their systems and prevent potential damage. A prompt update and configuration review are essential to minimize the risks of this vulnerability.