Apache Tomcat 9.0.92 < 9.0.96 multiple vulnerabilities

This Tenable plugin (211503) bundles two CVEs affecting Apache Tomcat 9.0.92 through 9.0.95, fixed in 9.0.96. CVE-2024-52316 (CVSS 9.8) is an authentication bypass that fires only when Tomcat is configured with a *custom* Jakarta Authentication (JASPIC) ServerAuthContext component that throws an exception during authentication *without* explicitly setting an HTTP failure status — Apache's own advisory notes no known components behave this way. CVE-2024-52317 (CVSS 6.5) is an HTTP/2 request/response object-recycling bug that can leak one user's request or response data to another user, a genuine information-disclosure concern wherever HTTP/2 is enabled on affected versions.

The vendor CVSS 9.8 is technically defensible *if* you assume the JASPIC precondition is met, but it wildly overstates real-world risk. Tenable's own VPR score — 4.9, medium — tells you what the vendor's own risk model actually thinks after adjusting for exploitability. The JASPIC prerequisite is so exotic that it functions as a near-perfect filter: the population of Tomcat deployments running custom ServerAuthContext implementations that also mishandle exceptions is vanishingly small. The HTTP/2 mixup is more broadly reachable but its impact ceiling is session/data leakage, not RCE or full auth bypass. Taken together, this plugin deserves a MEDIUM in any fleet that hasn't hand-rolled JASPIC plumbing.

Why this verdict

• Phantom prerequisite: CVE-2024-52316 requires a custom JASPIC ServerAuthContext that throws exceptions without setting failure status. Apache's advisory states no known component behaves this way. The CVSS 9.8 scores a scenario that effectively does not exist in production.
• Tenable's own VPR agrees: Tenable rates this plugin at VPR 4.9 (Medium) — a 5-point drop from the CVSS base. When the vendor's own risk model disagrees with the CVSS this strongly, the CVSS is measuring theoretical ceiling, not operational risk.
• Narrow version window: CVE-2024-52317 only affects 9.0.92–9.0.95, a span of four minor releases over ~3 months. Enterprises on LTS or slightly older tracks (9.0.x < 9.0.92) are not affected by the HTTP/2 bug at all.
• HTTP/2 termination architecture: Many enterprise Tomcat deployments terminate HTTP/2 at the load balancer or reverse proxy (NGINX, HAProxy, F5), meaning Tomcat's own HTTP/2 connector is never exercised — further reducing the CVE-2024-52317 population.
• Role multiplier: Tomcat serves as an application server across roles from dev sandboxes to production API tiers. In high-value roles (e.g., hosting an identity service or admin console), the HTTP/2 data-leakage bug could expose tokens or PII, but the blast radius is *per-session fragment leakage*, not domain takeover or fleet compromise. The JASPIC auth-bypass chain does not succeed in any role without the custom component. No high-value-role outcome reaches the domain/fleet/supply-chain threshold, so no verdict floor override applies.
• No exploitation signal: Not in CISA KEV, no confirmed campaigns, EPSS under 7%, PoC requires self-deployed vulnerable JASPIC provider. The threat-intel signal is quiet.

Why not higher?

Upgrading to HIGH would require either active exploitation evidence, a broadly reachable attack path leading to code execution, or a high-value-role blast radius reaching domain/fleet scale. None of these conditions are met. The auth-bypass path is gated by a prerequisite that doesn't exist in known deployments, and the HTTP/2 mixup caps at partial information disclosure. Tenable's own VPR of 4.9 corroborates that MEDIUM is already generous.

Why not lower?

CVE-2024-52317's HTTP/2 request/response mixup is a real bug that can leak user data without authentication on affected versions. It's not purely theoretical — any Tomcat instance serving HTTP/2 directly on 9.0.92–9.0.95 with concurrent users is vulnerable. Information disclosure between users is a meaningful confidentiality impact that keeps this above LOW. Additionally, the PoC availability for CVE-2024-52316, while requiring self-built prerequisites, means the mechanism is documented and understood.

1. Audit for JASPIC configuration — Run grep -r 'jaspic\|ServerAuthContext\|AuthConfigProvider' $CATALINA_BASE/conf/ $CATALINA_BASE/webapps/ across your fleet. If zero hits (expected for >99% of deployments), CVE-2024-52316 is not exploitable in your environment. Document this finding and deprioritize that CVE. No mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window.
2. Terminate HTTP/2 at the reverse proxy — If Tomcat connectors are configured with protocol="org.apache.coyote.http2.Http2Protocol" or h2 upgrade support, consider terminating HTTP/2 at your load balancer (NGINX, HAProxy, F5) and speaking HTTP/1.1 to Tomcat backends. This eliminates the CVE-2024-52317 attack surface entirely without patching. Implement within your standard change window.
3. Upgrade to Tomcat 9.0.96+ — The definitive fix. Version 9.0.96 was released October 2024. As a MEDIUM finding, the noisgate remediation SLA gives you 365 days. Plan this in your next quarterly patch cycle.
4. Restrict Tomcat management interfaces — Ensure /manager, /host-manager, and any admin endpoints are not exposed to untrusted networks. This limits the blast radius of any auth bypass, even a theoretical one.

Run this script on each Tomcat host as any user with read access to $CATALINA_HOME and $CATALINA_BASE. Example: bash check_tomcat_211503.sh /opt/tomcat. It checks the installed version and JASPIC configuration presence.

#!/usr/bin/env bash
# check_tomcat_211503.sh — Verify exposure to Tenable 211503 (CVE-2024-52316 + CVE-2024-52317)
# Usage: bash check_tomcat_211503.sh /path/to/tomcat
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-${CATALINA_HOME:-}}"

if [[ -z "$CATALINA_HOME" ]]; then
  echo "UNKNOWN — provide CATALINA_HOME as argument or env var"
  exit 2
fi

# Extract version
VERSION_FILE="$CATALINA_HOME/lib/catalina.jar"
if [[ ! -f "$VERSION_FILE" ]]; then
  echo "UNKNOWN — cannot find $VERSION_FILE"
  exit 2
fi

VERSION=$(unzip -p "$VERSION_FILE" org/apache/catalina/util/ServerInfo.properties 2>/dev/null \
  | grep 'server.number' | cut -d= -f2 | tr -d '[:space:]')

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not parse Tomcat version"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Check if in vulnerable range: 9.0.92 <= version <= 9.0.95
VULN_VERSION=false
if [[ "$MAJOR" -eq 9 && "$MINOR" -eq 0 && "$PATCH" -ge 92 && "$PATCH" -le 95 ]]; then
  VULN_VERSION=true
fi

if [[ "$VULN_VERSION" == false ]]; then
  echo "PATCHED — version $VERSION is outside the affected range (9.0.92–9.0.95)"
  exit 0
fi

# Check for JASPIC configuration (CVE-2024-52316 relevance)
CATALINA_BASE="${CATALINA_BASE:-$CATALINA_HOME}"
JASPIC_CONF="$CATALINA_BASE/conf/jaspic-providers.xml"
JASPIC_FOUND=false

if [[ -f "$JASPIC_CONF" ]] && grep -qi 'AuthConfigProvider\|ServerAuthContext' "$JASPIC_CONF" 2>/dev/null; then
  JASPIC_FOUND=true
fi

# Check for HTTP/2 connector (CVE-2024-52317 relevance)
SERVER_XML="$CATALINA_BASE/conf/server.xml"
H2_FOUND=false
if [[ -f "$SERVER_XML" ]] && grep -qiE 'Http2Protocol|h2c|upgradeProtocol.*HTTP2' "$SERVER_XML" 2>/dev/null; then
  H2_FOUND=true
fi

echo "JASPIC custom config detected: $JASPIC_FOUND"
echo "HTTP/2 connector detected: $H2_FOUND"

if [[ "$JASPIC_FOUND" == true ]]; then
  echo "VULNERABLE — version $VERSION is affected AND custom JASPIC configuration found (CVE-2024-52316 + CVE-2024-52317)"
  exit 1
elif [[ "$H2_FOUND" == true ]]; then
  echo "VULNERABLE — version $VERSION is affected AND HTTP/2 connector enabled (CVE-2024-52317)"
  exit 1
else
  echo "VULNERABLE — version $VERSION is in affected range, but neither JASPIC nor HTTP/2 connectors detected. Effective risk is minimal. Upgrade recommended."
  exit 1
fi

Sources

1. Tenable Plugin 211503
2. Apache Tomcat 9 Security Advisories
3. CVE-2024-52316 – Tarlogic Analysis
4. CVE-2024-52316 – GitHub Advisory GHSA-xcpr-7mr4-h4xq
5. CVE-2024-52316 PoC – TAM-K592
6. CVE-2024-52317 – oss-security Disclosure
7. CVE-2024-52317 – Red Hat Bugzilla
8. HKCERT Advisory – Apache Tomcat Multiple Vulnerabilities