CVE-2024-52316

What it actually does

The vulnerability allows authentication bypass in Tomcat when a custom JASPIC ServerAuthContext throws an exception without setting an HTTP failure status, causing the auth process to not fail properly.

Why it matters to the business

Organizations using affected Tomcat versions with custom auth components risk unauthorized access to protected resources, potentially leading to data breaches or system compromise, though no widespread exploitation known and EPSS low with stable trend.

How an attack unfolds

An attacker sends authentication requests that trigger an exception in the custom component without proper failure status, allowing the session to proceed as authenticated.

How to fix it

Upgrade Apache Tomcat to version 11.0.0, 10.1.31, or 9.0.96 depending on the branch in use.

How to confirm the fix worked

Verify Tomcat version is updated to fixed releases and test custom auth components for proper error handling with explicit HTTP status on exceptions.

Typical attack path

1. Identify target Tomcat server configured with custom JASPIC ServerAuthContext
2. Send crafted authentication requests designed to cause an exception in the component
3. Exploit the unchecked error condition so that failure status is not set
4. Bypass authentication and gain access to protected resources

How to detect it

Check application logs for authentication successes following exceptions in custom auth modules and review access logs for unexpected entries to protected areas.

What your security team should do

• Upgrade Tomcat immediately to patched versions 11.0.0, 10.1.31 or 9.0.96
• Audit and review any custom JASPIC implementations for proper exception handling
• Monitor authentication logs for anomalies after upgrade
• Apply least privilege principles to authentication components