Apache Tomcat has 'important' remote code execution on windows

News by Robert Abel

Security researchers reported a remote code execution on windows vulnerability in Apache Tomcat via the organisation's bug bounty programme.

Security researchers identified a remote code execution on windows vulnerability in Apache Tomcat.

The vulnerability is rated "Important" and was identified by an external security researcher and reported to the Apache Tomcat security team via the bug bounty programme, according to a 10 April  blog post.

The vulnerability leaves the CGI Servlet at risk due to a flaw in the way the JRE passes command line arguments to Windows and occurs when running on Windows with enableCmdLineArguments enabled.

Both the CGI Servlet and the CGI option enableCmdLineArguments are disabled by default in Tomcat 9.0.x and will be disabled by default in all versions in response to this vulnerability.

Researchers recommend users of affected versions should apply one of the following mitigations to ensure the CGI Servlet initialisation parameter enableCmdLineArguments is set to false and upgrading to the latest version of Apache Tomcat.

This article was originally published on SC Media US.

Find this article useful?

Get more great articles like this in your inbox every lunchtime

Video and interviews