[SECURITY] CVE-2024-56337 Apache Tomcat - RCE via write-enabled default servlet - CVE-2024-50379 mitigation was incomplete

CVE-2024-56337 Apache Tomcat - RCE via write-enabled default servlet - CVE-2024-50379 mitigation was incomplete Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.1 Apache Tomcat 10.1.0-M1 to 10.1.33 Apache Tomcat 9.0.0.M1 to 9.0.97

Re: CVE-2024-50379 Apache Tomcat - RCE via write-enabled default servlet

I truly appreciate your swift response, Mark. Thank you so much! On Thu, Dec 19, 2024 at 4:23 PM Mark Thomas wrote: > On 19/12/2024 10:49, Thiru wrote: > > Hello There, > > > > Good day! > > > > Could you kindly help clarify the following regarding CVE-2024-50379? > > > > In the default Tomcat

Re: CVE-2024-50379 Apache Tomcat - RCE via write-enabled default servlet

On 19/12/2024 10:49, Thiru wrote: Hello There, Good day! Could you kindly help clarify the following regarding CVE-2024-50379? In the default Tomcat setup, the readonly initialization parameter of the DefaultServlet is not write-enabled, even for a case-insensitive file system (Reference: http

RE: CVE-2024-50379 Apache Tomcat - RCE via write-enabled default servlet

Hello There, Good day! Could you kindly help clarify the following regarding CVE-2024-50379? In the default Tomcat setup, the readonly initialization parameter of the DefaultServlet is not write-enabled, even for a case-insensitive file system (Reference: https://tomcat.apache.org/tomcat-9.0-doc

[SECURITY] CVE-2024-50379 Apache Tomcat - RCE via write-enabled default servlet

CVE-2024-50379 Apache Tomcat - RCE via write-enabled default servlet Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.1 Apache Tomcat 10.1.0-M1 to 10.1.33 Apache Tomcat 9.0.0.M1 to 9.0.97 Description: If the default servlet is write

Re: Replacing default servlet using url-mapping

/81.20.00] At a guess, "/emner" is the context path. Is it so in Tomcat, that when you use the url-pattern “/“ that the rest of path is ignored when interpreting the original url? No. "/" is the default servlet. Is it different using other containers? No. Could b

Re: Replacing default servlet using url-mapping

/emner/81.20.00] At a guess, "/emner" is the context path. > Is it so in Tomcat, that when you use the url-pattern “/“ that the rest of > path is ignored when interpreting the original url? No. "/" is the default servlet. > Is it different using other containers?

Re: Replacing default servlet using url-mapping

I am not sure but i think the url pattern should be as below /* *Thanks and Regards,* Muralidhar Yaragalla. *http://yaragalla.blogspot.in/ * On Wed, Apr 13, 2016 at 4:42 PM, Rune Stilling wrote: > Hi list > > I have a question regarding the servlet-mapping prop

Replacing default servlet using url-mapping

Hi list I have a question regarding the servlet-mapping property in web.xml. Normally a url would look like this: http://host:port/context/servlet-path As many others I have tried to setup my servlet so that it matches the following: http://host:port/ I’m trying to obtain this by using the f

Static files with default servlet in tomcat 8.0.9

Please see my comments inline below. On 1/12/2015 8:55 AM, Srikanth Hugar wrote: Hello, I am trying to configure static files with default servlet in tomcat 8.0.9 but could not succeed. My directory structure in deployed webapp is: - WEB-INF - static -css -images -js

Re: Static files with default servlet in tomcat 8.0.9

On Mon, Jan 12, 2015 at 6:55 AM, Srikanth Hugar wrote: >I am trying to configure static files with default servlet in tomcat > 8.0.9 but could not succeed. > > My directory structure in deployed webapp is: > > - WEB-INF > - static > -css > -images >

Re: Static files with default servlet in tomcat 8.0.9

On Mon, Jan 12, 2015 at 9:55 AM, Srikanth Hugar wrote: > Hello, > >I am trying to configure static files with default servlet in tomcat > 8.0.9 but could not succeed. > > My directory structure in deployed webapp is: > > - WEB-INF > - static > -css >

Static files with default servlet in tomcat 8.0.9

Hello, I am trying to configure static files with default servlet in tomcat 8.0.9 but could not succeed. My directory structure in deployed webapp is: - WEB-INF - static -css -images -js - META-INF and* web.xml* configuration using default servlet is

Re: Configuration of Default Servlet for a single Container?

Burch wrote: >>>>> >>>>>> Have I overlooked a configuration trick that would allow me to use >>>>>> the >>>>>> webapp without a symlink, but still have the Default Servlet access >>>>>> exter

Re: Configuration of Default Servlet for a single Container?

, but still have the Default Servlet access external static content as if it were internal? http://tomcat.apache.org/tomcat-7.0-doc/config/context.html#Common_Attributes aliases? Thanks very much, as always, for your rapid response. I will follow that link with interest. If you switch to

Re: Configuration of Default Servlet for a single Container?

0 > From: br...@pingtoo.com > To: users@tomcat.apache.org > Subject: Re: Configuration of Default Servlet for a single Container? > > On 31/01/14 13:27, Brian Burch wrote: > > On 31/01/14 12:48, Mark Thomas wrote: > >> On 31/01/2014 12:42, Brian Burch wrote: > >

Re: Configuration of Default Servlet for a single Container?

t;> webapp without a symlink, but still have the Default Servlet access >>>> external static content as if it were internal? >>> >>> http://tomcat.apache.org/tomcat-7.0-doc/config/context.html#Common_Attributes >>> >>> >>> >>> aliases

Re: Configuration of Default Servlet for a single Container?

On 31/01/14 13:27, Brian Burch wrote: On 31/01/14 12:48, Mark Thomas wrote: On 31/01/2014 12:42, Brian Burch wrote: Have I overlooked a configuration trick that would allow me to use the webapp without a symlink, but still have the Default Servlet access external static content as if it were

Re: Configuration of Default Servlet for a single Container?

On 31/01/14 12:48, Mark Thomas wrote: On 31/01/2014 12:42, Brian Burch wrote: Have I overlooked a configuration trick that would allow me to use the webapp without a symlink, but still have the Default Servlet access external static content as if it were internal? http://tomcat.apache.org

Re: Configuration of Default Servlet for a single Container?

On 31/01/2014 12:42, Brian Burch wrote: > Have I overlooked a configuration trick that would allow me to use the > webapp without a symlink, but still have the Default Servlet access > external static content as if it were internal? http://tomcat.apache.org/tomcat-7.0-doc/config/con

Configuration of Default Servlet for a single Container?

I'm running Tomcat 7.0.42 under OpenJDK 7 on ubuntu linux 13.10, but I don't think this information is particularly relevant to my question. I currently have a servlet that relies on the standard Default Servlet to handle its static content. Specifically, the webapp is apache jspwi

Re: tomcat 6.0.20 - default servlet

Leo Donahue - PLANDEVX wrote: > Ugh. > > Sorry about that, wrong url. > > Should be: http://tomcat.apache.org/tomcat-6.0-doc/default-servlet.html Create a bugzilla entry against the docs and someone will get it fixed. If you wanted to provide a patch, that would be great. Mark --

RE: tomcat 6.0.20 - default servlet

- default servlet I'm making an argument in another forum regarding the directory listings being disabled by default in Tomcat 6.0.20 zip I downloaded the tomcat 6.0.20 zip and checked web.xml and listings are set to false. The online docs indicate otherwise. http://tomcat.apache.org/t

tomcat 6.0.20 - default servlet

I'm making an argument in another forum regarding the directory listings being disabled by default in Tomcat 6.0.20 zip I downloaded the tomcat 6.0.20 zip and checked web.xml and listings are set to false. The online docs indicate otherwise. http://tomcat.apache.org/tomcat-6.0-doc/default-serv

Re: Problem with overriding the default servlet on tc 6.0.18

Joseph S wrote: > > > Mark Thomas wrote: >> >>> --- Original Message --- >>> From: Joseph S >>> To: Tomcat Users List >>> Sent: 09/06/09, 01:58:45 >>> Subject: Re: Problem with overriding the default servlet on tc 6.0.18 >

Re: Problem with overriding the default servlet on tc 6.0.18

Mark Thomas wrote: --- Original Message --- From: Joseph S To: Tomcat Users List Sent: 09/06/09, 01:58:45 Subject: Re: Problem with overriding the default servlet on tc 6.0.18 Joseph S wrote: After restarting tomcat it started working by itself, but only if I've over

Re: Problem with overriding the default servlet on tc 6.0.18

> --- Original Message --- > From: Joseph S > To: Tomcat Users List > Sent: 09/06/09, 01:58:45 > Subject: Re: Problem with overriding the default servlet on tc 6.0.18 > > Joseph S wrote: > > After restarting tomcat it started working by itself, but only

Re: Problem with overriding the default servlet on tc 6.0.18

2009/6/9 Bill Barker : > >> Incidentally I discovered you can't by having an empty >> element, you have to have at least one in there or the >> default servlet will use the one in $CATALINA_BASE/conf/web.xml .  Bug or >> feature? > > I'd say an enhancem

Re: Problem with overriding the default servlet on tc 6.0.18

doing Servlet mapping so that the correct servlet is invoked for the welcome file. > Incidentally I discovered you can't by having an empty > element, you have to have at least one in there or the > default servlet will use the one in $CATALINA_BASE/conf/web.xml . Bug or > f

Re: Problem with overriding the default servlet on tc 6.0.18

Joseph S wrote: After restarting tomcat it started working by itself, but only if I've overriden the default in my web.xml More on this: I discovered that reloading the webapp itself doesn't work, I have to restart Tomcat itself in order to get the welcome file list override to take. --

Re: Problem with overriding the default servlet on tc 6.0.18

re or the default servlet will use the one in $CATALINA_BASE/conf/web.xml . Bug or feature? - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org

Problem with overriding the default servlet on tc 6.0.18

index.jsp that I no longer want to use. Am I doing something wrong or is this a bug? Incidentally I discovered you can't by having an empty element, you have to have at least one in there or the default servlet will use the one in $CATALINA_BASE/conf/web.xml . Bug or fe

Re: Default servlet url mapping issue

No spec violation - the default servlet only use getServletPath() to figure out what to get. By using a url pattern other than / - the url is actually split between getServletPath and getPathInfo. (and default servlet barfs) The simple workaround is to use a filter mapped to /resources/css

Re: Default servlet url mapping issue

Thank you Chuck, will definitely try it. On Wed, May 20, 2009 at 5:24 PM, Caldarale, Charles R wrote: >> From: Caldarale, Charles R >> Subject: RE: Default servlet url mapping issue >> >> The DefaultServlet does not currently support any other >> than /.  There&

RE: Default servlet url mapping issue

> From: Caldarale, Charles R > Subject: RE: Default servlet url mapping issue > > The DefaultServlet does not currently support any other > than /. There's a fairly simple change which seems to allow any > arbitrary pattern, which you might want to try. It will take m

Re: Default servlet url mapping issue

Thank you for the answers, I'll have to figure something out. And I'm taking back my words about spec violation :) Viktoras On Wed, May 20, 2009 at 4:46 PM, Caldarale, Charles R wrote: > The DefaultServlet does not currently support any other than /. >  There's a fairly simple change which se

RE: Default servlet url mapping issue

> From: Viktoras Agejevas [mailto:v.ageje...@gmail.com] > Subject: Default servlet url mapping issue > > > default > /resources/css/* > The DefaultServlet does not currently support any other than /. There's a fairly simple change which seems to a

Re: Default servlet url mapping issue

I don't see that either and I've read it a couple of times. Seems like this is just a limitation of the default servlet. --David Serge Fonville wrote: > Just out of interest, but where, how and why does it violate the spec? > > On Wed, May 20, 2009 at 3:33 PM,

Re: Default servlet url mapping issue

On Wed, May 20, 2009 at 4:38 PM, Serge Fonville wrote: > Just out of interest, but where, how and why does it violate the spec? "The container will recursively try to match the longest path-prefix." So as I understand all requests /resources/* should be directed to default serv

Re: Default servlet url mapping issue

Just out of interest, but where, how and why does it violate the spec? On Wed, May 20, 2009 at 3:33 PM, Mark Thomas wrote: > Viktoras Agejevas wrote: >> Hi, >> >> I have a weird default servlet url mapping issue >> (Tomcat 6.0.18 with fully default configuratio

Re: Default servlet url mapping issue

Viktoras Agejevas wrote: > Hi, > > I have a weird default servlet url mapping issue > (Tomcat 6.0.18 with fully default configuration). > > Here's my web.xml configuration: > > > > AnyServlet > /* > > > default >

Re: Default servlet url mapping issue

Have you tried a different order? On Wed, May 20, 2009 at 3:17 PM, Viktoras Agejevas wrote: > Hi, > > I have a weird default servlet url mapping issue > (Tomcat 6.0.18 with fully default configuration). > > Here's my web.xml configuration: > > > >      AnySer

Default servlet url mapping issue

Hi, I have a weird default servlet url mapping issue (Tomcat 6.0.18 with fully default configuration). Here's my web.xml configuration: AnyServlet /* default /resources/css/* 1. If I request http://localhost:8080/whatever AnyServlet handles the request. -

Re: Default servlet doesn't encode URI on redirect?

Benoit Maisonny wrote: Sorry, not always easy to keep a thread with the huge traffic on this list. Christopher Schultz wrote: Benoit, Benoit Maisonny wrote: | Christopher Schultz wrote: |> |> Benoit, |> |> Benoit Maisonny wrote: |> | I suspect someone forgot to encode the URI in the Location:

Re: Default servlet doesn't encode URI on redirect?

Sorry, not always easy to keep a thread with the huge traffic on this list. Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Benoit, Benoit Maisonny wrote: | Christopher Schultz wrote: |> |> Benoit, |> |> Benoit Maisonny wrote: |> | I suspect someone forgot to encode th

Re: Default servlet doesn't encode URI on redirect?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Benoit, Benoit Maisonny wrote: | Christopher Schultz wrote: |> |> Benoit, |> |> Benoit Maisonny wrote: |> | I suspect someone forgot to encode the URI in the Location: HTTP header |> | on the 302 response, but maybe there is something missing in our

Re: Default servlet doesn't encode URI on redirect?

Christopher Schultz wrote: Benoit, Benoit Maisonny wrote: | I suspect someone forgot to encode the URI in the Location: HTTP header | on the 302 response, but maybe there is something missing in our | configuration? What is the default character set of the running JVM? UTF-8, according to ja

Re: Default servlet doesn't encode URI on redirect?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Benoit, Benoit Maisonny wrote: | I suspect someone forgot to encode the URI in the Location: HTTP header | on the 302 response, but maybe there is something missing in our | configuration? What is the default character set of the running JVM? - -ch

Default servlet doesn't encode URI on redirect?

ain;q=0.8,image/png,*/*;q=0.5 Accept-Language: fr-fr,en;q=0.7,en-gb;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive 2nd RESPONSE from Default Servlet = HTTP/1.x 404 /gv-publications/h%E9h%E9/draft/ Server

Re: Overriding Default Servlet?

Thanks everyone for the info magic mailing list this! My interest in the default servlet is 2 fold A Resin user asked whether tomcat could do this I thought... be kind of cool to add that functionality and maybe extend it to full paths on HTML PDF files files... so one can

Re: Overriding Default Servlet?

It can be extended like any other java class. In reality - there are probably 2 better solutions than extending (or replacing) the Default Servlet. 1) Create a filter which does what you need then pass control to the default servlet. (chain.doFilter()) 2) Create your own default servlet but

Re: Overriding Default Servlet?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Johnny, Johnny Kewl wrote: > So this plebian is asking... wot does override actually mean?? > > I do know that if one creates a servlet and say maps it as /* > that will effectively block the default servlet is that wot >

Overriding Default Servlet?

Read some tomcat docs where it said one can override the default servlet... and then it gets a little cocky and says if you cant read the code... this is not for you (pleb!) So this plebian is asking... wot does override actually mean?? I do know that if one creates a servlet and say maps it

Re: How to disable default servlet?

Narayanaswamy, Mohan wrote: We use shared Apache+Tomcat, We need apache to serve static and tomcat for dynamic, By no way tomcat should provide static resources. Sounds like security-by-obscurity. Either configure apache properly and tomcat will not get any requests for static resources - o

RE: How to disable default servlet?

I have removed the entry, but I am just getting 404 error alone for dynamic and static request. Regards, Mohan -Original Message- From: Hassan Schroeder [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 09, 2007 12:16 PM To: Tomcat Users List Subject: Re: How to disable default servlet

Re: How to disable default servlet?

On 1/8/07, Narayanaswamy, Mohan <[EMAIL PROTECTED]> wrote: I need to disable default servlet to restrict serving the static pages. We use shared Apache+Tomcat, We need apache to serve static and tomcat for dynamic, By no way tomcat should provide static resources. If you've config

How to disable default servlet?

I need to disable default servlet to restrict serving the static pages. We use shared Apache+Tomcat, We need apache to serve static and tomcat for dynamic, By no way tomcat should provide static resources. Regards, Mohan This email is confidential. If you are not the addressee tell the sender

RE: Default servlet

Mark is right (of course)... my bad. -Original Message- From: Mark Thomas [mailto:[EMAIL PROTECTED] Sent: Monday, May 08, 2006 10:14 PM To: Tomcat Users List Subject: Re: Default servlet Tim Lucia wrote: > Look in conf/web.xml -- it is commented out by default. Not it isn

Re: Default servlet

Tim Lucia wrote: > Look in conf/web.xml -- it is commented out by default. Not it isn't. The default servlet is enabled by default. > It is widely > considered evil to use the default servlet. At a minimum, it poses security > risks. Again, no. The default servlet is not con

Re: Default servlet

The default servlet already is mapped to / so your mapping below is not needed. Tomcat's default servlet is defined in $CATALINA_HOME/conf/web.xml -Tim Dmitry S. Kravchenko wrote: Hi! How can I configure existance of default servlet? This servlet, as I can see, allows me t

RE: Default servlet

Look in conf/web.xml -- it is commented out by default. It is widely considered evil to use the default servlet. At a minimum, it poses security risks. Tim -Original Message- From: Dmitry S. Kravchenko [mailto:[EMAIL PROTECTED] Sent: Monday, May 08, 2006 11:23 AM To: users

Default servlet

Hi! How can I configure existance of default servlet? This servlet, as I can see, allows me to use following mappings default /res/* See, that I don't want to write this servlet by my own, it should already exist somewhere in the Tomcat. Thnx.

RE: configuring the default servlet

CTED] Sent: 25 March 2006 22:31 To: Tomcat Users List Subject: configuring the default servlet I have several web applications running in the same instance of Tomcat 5.5 and I'd like to configure the default servlet differently for some of them. The default configuration is in the

Re: configuring the default servlet

myapp-default / This has the downside of loading DefaultServlet twice for each app, but that shouldn't be too bad in most cases. > thx, > Rachel > > Farrow, Marc wrote: >> The first question I have is do you want/need to keep the default servlet >>

Re: configuring the default servlet

n on this? thx, Rachel Farrow, Marc wrote: The first question I have is do you want/need to keep the default servlet definition in your CATALINA_BASE/conf/web.xml file? If not, then just remove it from there and just push the "default" configuration to every web.xml for each application

RE: configuring the default servlet

The first question I have is do you want/need to keep the default servlet definition in your CATALINA_BASE/conf/web.xml file? If not, then just remove it from there and just push the "default" configuration to every web.xml for each application. If you have a need for the default con

configuring the default servlet

I have several web applications running in the same instance of Tomcat 5.5 and I'd like to configure the default servlet differently for some of them. The default configuration is in the web.xml file in the CATALINA_BASE/conf directory, and each webapp has its own web.xml file in its WE

url rewriting for directory listings in default servlet

Hi, i wanna list directory entries with german special chars like ä, ü, ö. this chars were not urlencodiert from the DefaultServlet. my machins LANG is de_DE an i start tomcat with -Duser.language=de -Duser.region=DE. what i am doing wrong? thanks, thomas ---

Re: Can you intercept the default Servlet ? stack servlets ? forward to specific class ?

c, so I've implemented a hard coded exclusion list in the filter. SecurityContextFilter /subdir/* Tim Funk wrote: There called ServletFilters. -Tim Darryl L. Miles wrote: I would like to change a sub-tree (/subdir) of my web-app so that I run every request runs through my own default

Re: Can you intercept the default Servlet ? stack servlets ? forward to specific class ?

There called ServletFilters. -Tim Darryl L. Miles wrote: I would like to change a sub-tree (/subdir) of my web-app so that I run every request runs through my own default servlet (for a security check) then if it drops out of the bottom I wish to forward to tomcat's default se

RE: Can you intercept the default Servlet ? stack servlets ? forward to specific class ?

an you intercept the default Servlet ? stack servlets ? forward > to specific class ? > > > I would like to change a sub-tree (/subdir) of my web-app so that I run > every request runs through my own default servlet (for a security check) > then if it drops out of the bottom I wish to

Can you intercept the default Servlet ? stack servlets ? forward to specific class ?

I would like to change a sub-tree (/subdir) of my web-app so that I run every request runs through my own default servlet (for a security check) then if it drops out of the bottom I wish to forward to tomcat's default servlet. Does Servlet technology allow the stacking of servlets, so