Apache Tomcat 8

Tenable plugin 106976 rolls up two Apache Tomcat 8 fixes shipped in 8.0.50: CVE-2018-1305, where servlet annotation-based security constraints were applied only after a servlet loaded, and CVE-2018-1304, where a security constraint mapped to the empty-string context root could be ignored. For Tomcat 8.0.0.RC1 through 8.0.49, the outcome is possible unauthorized access to protected application resources if the deployed webapp uses the affected security patterns.

Vendor MEDIUM is basically right. The impact is real, but the reachable population is much smaller than a generic remote Tomcat bug because exploitation depends on how the application defines security constraints, not just Tomcat being present. Nessus also says this plugin is a version-only check, which means a lot of hits are patch-priority noise unless the hosted app actually uses the vulnerable mappings.

Why this verdict

• App-specific prerequisite: the attacker only wins if the hosted webapp actually uses annotation-based constraints or the empty-string context-root mapping pattern.
• Version-only detection: Nessus says plugin 106976 relies on self-reported version and does not validate exploitability, so many findings are not immediately actionable fire alarms.
• No live-fire intel: no KEV listing and no strong primary-source evidence of broad in-the-wild exploitation keeps this out of HIGH.

Why not higher?

This is not a generic unauthenticated Tomcat takeover. There is no built-in code execution, no trivial one-packet exploit path, and no evidence in the reviewed source set that attackers are mass-scanning or mass-weaponizing these exact CVEs. The required application behavior sharply narrows real exposure.

Why not lower?

If the application does rely on the affected constraint handling, the result is an actual authorization bypass to protected resources, not a cosmetic bug. On externally reachable business apps, that can mean real data exposure or unauthorized actions, so writing it off as LOW would understate the downside.

1. Restrict direct access — Put affected Tomcat apps behind a reverse proxy, VPN, or IP allowlist where possible to reduce unauthenticated route probing. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but use this sooner for internet-facing apps with sensitive routes.
2. Enforce auth in application code — Where you own the app, do not rely solely on container-managed constraints for high-value routes; add explicit authorization checks in the application layer. This reduces exposure even if Tomcat's constraint mapping is wrong, and should be prioritized before the 365-day remediation window closes.
3. Review web.xml and annotations — Search for empty-string URL patterns, servlet-security annotations, and root-context protections that assume Tomcat container enforcement. Validate those patterns now on exposed apps, then patch within the noisgate remediation SLA for this severity.
4. Alert on anonymous access to protected paths — Tune reverse-proxy and app logging so unauthenticated 200 responses on routes expected to redirect or deny are visible. This is a low-cost detective control while you work through patch validation and complete remediation inside the 365-day window.

Run this on the target Tomcat host or inside the container image layer where Tomcat is installed. Invoke it as bash verify_tomcat_106976.sh /opt/tomcat or point it directly at catalina.jar; no root is required if you can read Tomcat's lib/ directory.

#!/usr/bin/env bash
# verify_tomcat_106976.sh
# Checks whether an Apache Tomcat installation is in the vulnerable range for Tenable plugin 106976
# Vulnerable upstream range: 8.0.0.RC1 <= version < 8.0.50
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET="${1:-}"

if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <tomcat_home | path_to_catalina.jar>"
  echo "UNKNOWN"
  exit 2
fi

find_catalina_jar() {
  local t="$1"
  if [[ -f "$t" && "$(basename "$t")" == "catalina.jar" ]]; then
    echo "$t"
    return 0
  fi
  if [[ -d "$t" ]]; then
    if [[ -f "$t/lib/catalina.jar" ]]; then
      echo "$t/lib/catalina.jar"
      return 0
    fi
    local hit
    hit=$(find "$t" -type f -name catalina.jar 2>/dev/null | head -n1)
    if [[ -n "$hit" ]]; then
      echo "$hit"
      return 0
    fi
  fi
  return 1
}

extract_version() {
  local jar="$1"
  local tmpdir
  tmpdir=$(mktemp -d)
  trap 'rm -rf "$tmpdir"' EXIT

  if ! command -v unzip >/dev/null 2>&1; then
    return 1
  fi

  unzip -qq -o "$jar" org/apache/catalina/util/ServerInfo.properties -d "$tmpdir" >/dev/null 2>&1 || true
  unzip -qq -o "$jar" META-INF/MANIFEST.MF -d "$tmpdir" >/dev/null 2>&1 || true

  local v=""
  if [[ -f "$tmpdir/org/apache/catalina/util/ServerInfo.properties" ]]; then
    v=$(grep -E '^server.info=' "$tmpdir/org/apache/catalina/util/ServerInfo.properties" | sed -E 's/^server.info=Apache Tomcat\/?//')
  fi

  if [[ -z "$v" && -f "$tmpdir/META-INF/MANIFEST.MF" ]]; then
    v=$(grep -Ei '^Implementation-Version:' "$tmpdir/META-INF/MANIFEST.MF" | head -n1 | sed -E 's/^Implementation-Version:[[:space:]]*//I')
  fi

  rm -rf "$tmpdir"
  trap - EXIT

  if [[ -n "$v" ]]; then
    echo "$v"
    return 0
  fi
  return 1
}

version_to_sortable() {
  # Converts 8.0.0.RC1 -> 8.0.0~RC1 for sort -V friendliness
  echo "$1" | sed -E 's/\.RC/~RC/I; s/-/~/'
}

version_lt() {
  local a b
  a=$(version_to_sortable "$1")
  b=$(version_to_sortable "$2")
  [[ "$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)" != "$b" && "$a" != "$b" ]]
}

version_ge() {
  local a b
  a=$(version_to_sortable "$1")
  b=$(version_to_sortable "$2")
  [[ "$a" == "$b" ]] && return 0
  [[ "$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)" == "$b" ]]
}

JAR=$(find_catalina_jar "$TARGET") || {
  echo "UNKNOWN"
  exit 2
}

VERSION=$(extract_version "$JAR") || {
  echo "UNKNOWN"
  exit 2
}

# Normalize common prefixes/spaces
VERSION=$(echo "$VERSION" | tr -d '\r' | xargs)

if version_ge "$VERSION" "8.0.0.RC1" && version_lt "$VERSION" "8.0.50"; then
  echo "VULNERABLE"
  exit 1
fi

if version_ge "$VERSION" "8.0.50"; then
  echo "PATCHED"
  exit 0
fi

# Outside the plugin's affected upstream branch
if version_lt "$VERSION" "8.0.0.RC1"; then
  echo "PATCHED"
  exit 0
fi

echo "UNKNOWN"
exit 2

Sources

1. Tenable plugin 106976
2. Apache Tomcat 8 security page
3. NVD CVE-2018-1304
4. NVD CVE-2018-1305
5. Debian DSA-4281 tomcat8 security update
6. Ubuntu CVE-2018-1305 status
7. Tenable CVE-2018-1305
8. CISA Known Exploited Vulnerabilities Catalog