CVE-2019-0232
Description
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).
How to fix
- org.apache.tomcat.embed:tomcat-embed-core9.0.17, 8.5.40, 7.0.94 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | 7.0.0 ≤ v ≤ 7.0.93, 8.5.0 ≤ v ≤ 8.5.39, 9.0.1 ≤ v ≤ 9.0.17, 9.0.0 | — |
| org.apache.tomcat.embed:tomcat-embed-coreMaven | 9.0.0.M1 ≤ v < 9.0.17, 8.0.0 ≤ v < 8.5.40, 7.0.0 ≤ v < 7.0.94 | 9.0.17, 8.5.40, 7.0.94 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.