CVE-2024-6162

What it actually does

Race condition in Undertow AJP listener where a shared buffer is reused for decoding URL-encoded request paths across concurrent requests, resulting in corrupted path information and incorrect resource access attempts.

Why it matters to the business

Legitimate application resources become inaccessible, producing errors that disrupt service availability and user access without requiring authentication.

How an attack unfolds

An attacker issues multiple simultaneous requests containing URL-encoded paths to the AJP listener, triggering concurrent decoding that reuses the same buffer and causes path information to be swapped or lost across requests.

How to fix it

Upgrade to a patched Undertow release that isolates path decoding buffers per request; until available, restrict or disable the AJP listener and enforce request throttling.

How to confirm the fix worked

Replay concurrent URL-encoded path requests in a test environment against the updated Undertow version and confirm that path information remains isolated with no erroneous 404 responses.

Typical attack path

1. Identify AJP listener endpoints accepting URL-encoded paths
2. Send high volumes of concurrent requests with varied URL-encoded paths
3. Observe resulting 404 responses or application errors on otherwise valid resources

How to detect it

Review AJP and application logs for clusters of 404 errors on valid paths that coincide with periods of high concurrent request volume; correlate with Undertow request handling timestamps.

What your security team should do

• Apply the next available Undertow security update as soon as released
• Disable or firewall-restrict the AJP listener if not required for operation
• Add monitoring rules for sudden spikes in 404 errors on known-valid paths