Apache Tomcat 8

Tenable plugin 111067 flags Tomcat 8.0.0.RC1 through 8.0.52 because 8.0.53 fixed two issues: CVE-2018-8014 (the Tomcat CORS filter shipped with insecure defaults that could allow credentialed cross-origin access if admins used the default filter behavior) and CVE-2018-8034 (Tomcat's WebSocket client did not verify hostnames by default over TLS). Neither bug is a straight remote server compromise in a default enterprise deployment.

The vendor/NVD severity is inflated versus reality. Apache rated both flaws Low, and the Apache advisory explicitly says most users are not expected to be impacted by CVE-2018-8014; CVE-2018-8034 hits outbound WebSocket client use, not the normal inbound Tomcat server path. Tenable is also clear this plugin is version-only and did not test exploitability, so treating this as a critical patch fire is the wrong move.

Why this verdict

• Optional feature dependency: the dominant path needs the Tomcat CORS filter to be enabled and left with insecure defaults; that narrows real exposure well below 'every Tomcat host'.
• Attacker-position friction: CVE-2018-8034 is a WebSocket *client* hostname-validation bug, which implies outbound client use plus MITM/on-path capability or equivalent prior compromise.
• Limited blast radius: even if CVE-2018-8014 is exploitable, impact is bounded to browser-mediated application data or actions under a victim session, not straight Tomcat or OS takeover.

Why not higher?

There is no KEV listing, no credible public exploitation wave, and no direct unauthenticated server-compromise primitive in the upstream advisory. The strongest 'critical' signal here is an NVD score for CVE-2018-8014, but Apache's own description and the required prerequisites cut that down hard in real environments.

Why not lower?

I am not calling it IGNORE because these are still real flaws, and a subset of enterprises absolutely do run sensitive browser apps with sloppy CORS or custom outbound WebSocket logic. Also, Tomcat 8.0.x is end-of-life, so a version-only finding can still be a useful marker for stale platform debt even when this specific vuln bundle is low priority.

1. Lock down CORS explicitly — Review apps using Tomcat's CORS filter and set explicit allowed origins, methods, and credential behavior rather than relying on defaults. For a LOW verdict there is no mitigation SLA; handle this as backlog hygiene during normal application hardening.
2. Inventory outbound WebSocket client use — Identify apps that use Tomcat's WebSocket client over TLS and verify hostname validation through code review or test harnesses. Again, for LOW there is no mitigation SLA; fold this into regular secure configuration review rather than emergency change windows.
3. Prioritize supported Tomcat branches — Treat any surviving 8.0.x footprint as lifecycle debt and move workloads to a supported branch so future Tomcat security fixes are available. For LOW, there is no special deadline from noisgate; schedule in the routine modernization queue.

Run this on the target host or from an auditor workstation with filesystem access to the Tomcat install. Invoke it with python3 check_tomcat_111067.py /opt/tomcat or python check_tomcat_111067.py C:\Tomcat; no admin rights are required if you can read lib/catalina.jar.

#!/usr/bin/env python3
# check_tomcat_111067.py
# Detects whether a Tomcat installation falls into Tenable plugin 111067 scope
# (Apache Tomcat 8.0.0.RC1 through 8.0.52, fixed in 8.0.53).
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import zipfile


def read_server_info(catalina_home):
    jar_path = os.path.join(catalina_home, 'lib', 'catalina.jar')
    if not os.path.isfile(jar_path):
        return None, f'missing {jar_path}'

    candidates = [
        'org/apache/catalina/util/ServerInfo.properties',
        'org/apache/catalina/util/serverinfo.properties',
    ]

    try:
        with zipfile.ZipFile(jar_path, 'r') as zf:
            for name in candidates:
                try:
                    data = zf.read(name).decode('utf-8', errors='ignore')
                    m = re.search(r'server\.info\s*=\s*Apache Tomcat/([^\s\r\n]+)', data)
                    if m:
                        return m.group(1).strip(), None
                except KeyError:
                    continue
    except Exception as e:
        return None, str(e)

    return None, 'server.info not found in catalina.jar'


def parse_version(ver):
    # Handles 8.0.53, 8.0.0.RC1, 8.0.0-RC1, 8.0.0RC1
    raw = ver.strip()
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)(?:[.-]?(?:RC)(\d+))?$', raw, re.IGNORECASE)
    if not m:
        return None
    major = int(m.group(1))
    minor = int(m.group(2))
    patch = int(m.group(3))
    rc = int(m.group(4)) if m.group(4) else None
    return (major, minor, patch, rc)


def compare_versions(a, b):
    # Compare tuples (major, minor, patch, rc) where rc is None for final release.
    # RC is considered lower than final release of same numeric version.
    for i in range(3):
        if a[i] < b[i]:
            return -1
        if a[i] > b[i]:
            return 1
    arc = -1 if a[3] is not None else 10**9
    brc = -1 if b[3] is not None else 10**9
    if arc < brc:
        return -1
    if arc > brc:
        return 1
    return 0


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_tomcat_111067.py <CATALINA_HOME>')
        sys.exit(2)

    catalina_home = sys.argv[1]
    version, err = read_server_info(catalina_home)
    if not version:
        print(f'UNKNOWN - could not determine Tomcat version: {err}')
        sys.exit(2)

    parsed = parse_version(version)
    if not parsed:
        print(f'UNKNOWN - unrecognized Tomcat version format: {version}')
        sys.exit(2)

    lower = (8, 0, 0, 1)   # 8.0.0.RC1
    upper_fixed = (8, 0, 53, None)

    if parsed[0] != 8 or parsed[1] != 0:
        print(f'UNKNOWN - Tomcat {version} is outside plugin 111067 branch scope (expects 8.0.x)')
        sys.exit(2)

    if compare_versions(parsed, lower) >= 0 and compare_versions(parsed, upper_fixed) < 0:
        print(f'VULNERABLE - Apache Tomcat/{version} is in 8.0.0.RC1 through 8.0.52')
        sys.exit(1)

    if compare_versions(parsed, upper_fixed) >= 0:
        print(f'PATCHED - Apache Tomcat/{version} is 8.0.53 or later in the 8.0.x branch')
        sys.exit(0)

    print(f'UNKNOWN - Apache Tomcat/{version} did not match expected vulnerable range logic')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Tenable plugin 111067
2. Apache Tomcat 8 security advisories
3. NVD CVE-2018-8014
4. NVD CVE-2018-8034
5. CISA Known Exploited Vulnerabilities catalog
6. FIRST EPSS API documentation
7. Amazon Linux advisory for CVE-2018-8014
8. Censys blog on finding Apache Tomcat servers