Yemoli

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 9.0.0-M1 through 11.0.1 Description: The issue is a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that can be exploited to bypass case sensitivity checks and execute arbitrary code. This can be done by uploading a file that can be turned into malicious JSP code, resulting in remote code execution. The exploit can be carried out on case-insensitive file systems where Tomcat's default servlet has write functionality enabled. Over 894,000 Apache Tomcat applications are potentially vulnerable to this exploit. A proof-of-concept has been released, and it is expected that more exploitation will occur. Recommendations: Update to patched versions of Apache Tomcat and adjust Java configuration accordingly to prevent remote code execution. As a temporary workaround, consider disabling the default servlet's write functionality on case-insensitive file systems to minimize the risk of exploitation. Restrict access to the vulnerable `jsp` files to prevent malicious code execution until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Apache HertzBeat (incubating) versions prior to 1.6.1 Description: This issue is related to an improper neutralization of special elements used in a command, also known as a 'Command Injection' vulnerability. The vulnerability can only be exploited by authorized attackers. Recommendations: For Apache HertzBeat (incubating) versions prior to 1.6.1, upgrade to version 1.6.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive commands or functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 **Description** The issue is related to a vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware, specifically in the Core component. This vulnerability allows an unauthenticated attacker with network access via T3, IIOP to compromise the Oracle WebLogic Server. Successful attacks can result in the takeover of the Oracle WebLogic Server. It is estimated that over 18,000 services are potentially affected. The vulnerability can be exploited by sending specially crafted network packets, allowing an attacker to gain full access to the vulnerable software. **Recommendations** For Oracle WebLogic Server version 12.2.1.4.0, update to a newer version to mitigate the risk. For Oracle WebLogic Server version 14.1.1.0.0, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the T3 and IIOP protocols to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.4.0 through 14.1.1.0.0 **Description** The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via T3 or IIOP to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. **Recommendations** For versions 12.2.1.4.0 and 14.1.1.0.0, update to a version that includes the fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions prior to 11.0.2, 10.1.34, or 9.0.98. **Description** The Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue. **Recommendations** - Upgrade Apache Tomcat to versions 11.0.2+, 10.1.34+, or 9.0.98+ to patch CVE-2024-50379 and CVE-2024. - Temporarily restrict write access to the default servlet if immediate update is not possible. - Disable the “examples” web application in Apache Tomcat to protect against the vulnerability. - Set the system property sun.io.useCanonCaches to false if using Java 8 or Java 11. - Set the system property sun.io.useCanonCaches to false if using Java 17. - No further configuration is required for Java 21 onwards. - Tomcat 11.0.3, 10.1.35, and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

**Name of the Vulnerable Software and Affected Versions** SOFARPC versions prior to 5.12.0 **Description** SOFARPC is a Java RPC framework that defaults to using the SOFA Hessian protocol to deserialize received data. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. However, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. **Recommendations** For SOFARPC versions prior to 5.12.0, upgrade to version 5.12.0 to fix the issue. As a temporary workaround, users can add additional blacklists by using the `-Drpc serialize blacklist override` parameter, for example, `-Drpc serialize blacklist override=org.apache.xpath`.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server version 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 **Description** A flaw in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware, is caused by insufficient input validation and a post-deserialization issue. This allows an unauthenticated remote attacker with network access to compromise the server via T3 or IIOP protocols. Successful exploitation can lead to unauthorized access to critical data, complete access to all accessible server data, or remote code execution. There is evidence of active exploitation in the wild, with threat actors targeting internet-exposed servers to deploy ransomware, steal data, or install crypto-miners. **Recommendations** Apply the July 2024 Critical Patch Update for version 12.2.1.4.0. Apply the July 2024 Critical Patch Update for version 14.1.1.0.0. As a temporary mitigation, block external access to T3 and IIOP protocols (default port 7001) and restrict exposure to trusted networks only.

**Name of the Vulnerable Software and Affected Versions** Apache Dubbo versions 2.7.21 and prior versions Apache Dubbo versions 3.0.13 and prior versions Apache Dubbo versions 3.1.5 and prior versions **Description** A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. The issue is related to the mechanism of deserialization in the Apache Dubbo RPC framework, allowing a remote attacker to execute arbitrary code. **Recommendations** For Apache Dubbo versions 2.7.21 and prior versions, update to a version later than 2.7.21. For Apache Dubbo versions 3.0.13 and prior versions, update to a version later than 3.0.13. For Apache Dubbo versions 3.1.5 and prior versions, update to a version later than 3.1.5. As a temporary workaround, consider disabling the dubbo generic invoke functionality until a patch is available. Restrict access to the vulnerable RPC endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache Dubbo versions 2.7.17 and prior Apache Dubbo versions 3.0.11 and prior Apache Dubbo versions 3.1.0 and prior dubbo hessian-lite versions 3.2.12 and earlier **Description** A deserialization vulnerability existed in dubbo hessian-lite, which could lead to malicious code execution. **Recommendations** For Apache Dubbo versions 2.7.17 and prior, update to a version later than 2.7.17. For Apache Dubbo versions 3.0.11 and prior, update to a version later than 3.0.11. For Apache Dubbo versions 3.1.0 and prior, update to a version later than 3.1.0. For dubbo hessian-lite versions 3.2.12 and earlier, update to a version later than 3.2.12.