CVE-2024-52316 PoC — Apache Tomcat: Authentication bypass when using Jakarta Authentication API

Source

https://github.com/TAM-K592/CVE-2024-52316

Associated Vulnerability

Title: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)
Description:Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

Description

CVE-2024-52316 - Apache Tomcat Authentication Bypass Vulnerability

Readme

🚨🚨CVE-2024-52316🚨🚨

🚨🚨CVE-2024-52316 - Apache Tomcat Authentication Bypass Vulnerability

Overview

CVE202452316 is an authentication bypass vulnerability identified in Apache Tomcat. This issue arises when Tomcat is configured with a custom Jakarta Authentication (formerly JASPIC) `ServerAuthContext` component. If an exception occurs during the authentication process and the component does not explicitly set an HTTP status code to indicate failure, the authentication process may incorrectly succeed, allowing an attacker to bypass authentication.

 Affected Versions
The following versions of Apache Tomcat are affected by this vulnerability:

| Version Series      | Affected Versions               |
|---------------------|----------------------------------|
| Apache Tomcat 11.0  | Versions prior to 11.0.0        |
| Apache Tomcat 10.1  | Versions prior to 10.1.31       |
| Apache Tomcat 9.0   | Versions prior to 9.0.96        |

 Exploitability
 
 Attack Vector
 
 Exploitation: An attacker could exploit this vulnerability by manipulating the authentication flow to trigger an exception in the custom `ServerAuthContext`. If the exception is not properly handled (i.e., no failure status is set), the attacker could gain unauthorized access.
 
 Potential Impact:
   Unauthorized access to sensitive data.
   System compromise or privilege escalation.
   Circumvention of resource isolation mechanisms.

 Mitigation
 
Upgrades

It is strongly recommended to upgrade to a patched version of Apache Tomcat to address this issue:

 Apache Tomcat 11.0.0 or later.
 Apache Tomcat 10.1.31 or later.
 Apache Tomcat 9.0.96 or later.

 Configuration Best Practices
1. Ensure any custom Jakarta Authentication `ServerAuthContext` components properly handle exceptions and explicitly set failure HTTP status codes (`401 Unauthorized` or `403 Forbidden`).
2. Regularly audit custom authentication logic for security flaws.



 References

 Apache Tomcat Security Advisory for CVE202452316](https://tomcat.apache.org/security11.html)
 
 Apache Mailing List Discussion](https://lists.apache.org/thread/dz6nv1j2mm1m3hqfxdtt392qlo7xf6z0)
 
 Apache Tomcat Downloads](https://tomcat.apache.org/download11.cgi)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →