CVE-2020-8022: Apache Tomcat Privilege Escalation Flaw

CVE-2020-8022 Overview

CVE-2020-8022 is an Incorrect Default Permissions vulnerability affecting the packaging of Apache Tomcat on multiple SUSE Linux Enterprise products. This flaw allows local attackers who have access to the tomcat group to escalate their privileges to root, potentially leading to complete system compromise.

The vulnerability stems from improper permission settings in the SUSE-specific Tomcat packaging, where critical files and directories are configured with overly permissive access rights. An attacker with local access and membership in the tomcat group can exploit these misconfigurations to gain root-level access to the affected system.

Critical Impact

Local attackers can escalate from the tomcat group to root, enabling full system compromise on affected SUSE Linux Enterprise servers and OpenStack Cloud deployments.

Affected Products

• Apache Tomcat (versions prior to 8.0.53-29.32.1 and 9.0.35-3.39.1/3.57.3)
• SUSE Enterprise Storage 5
• SUSE Linux Enterprise Server 12-SP2-BCL, 12-SP2-LTSS, 12-SP3-BCL, 12-SP3-LTSS, 12-SP4, 12-SP5, 15-LTSS
• SUSE Linux Enterprise Server for SAP 12-SP2, 12-SP3, 15
• SUSE OpenStack Cloud 7, 8
• SUSE OpenStack Cloud Crowbar 8
• openSUSE Leap 15.1

Discovery Timeline

• June 29, 2020 - CVE-2020-8022 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-8022

Vulnerability Analysis

This vulnerability is classified as CWE-276 (Incorrect Default Permissions), which occurs when software incorrectly sets permissions for resources, enabling unauthorized access to protected resources. In the case of CVE-2020-8022, the SUSE packaging of Apache Tomcat sets default permissions that are too permissive, allowing users in the tomcat group to modify files that should only be writable by root.

The vulnerability requires local access and membership in the tomcat group as a prerequisite, but once these conditions are met, exploitation can lead to complete root access. This makes the vulnerability particularly dangerous in shared hosting environments or systems where multiple users have access to the tomcat group.

Root Cause

The root cause lies in the SUSE-specific packaging scripts for Apache Tomcat, which configure file and directory permissions incorrectly during installation or upgrades. Specifically, certain configuration files, startup scripts, or library directories are assigned group-writable permissions to the tomcat group, when they should be read-only or restricted to root ownership.

This packaging flaw affects multiple versions of Tomcat across various SUSE products:

• Tomcat 8.x versions prior to 8.0.53-29.32.1 on SLES 12-based systems
• Tomcat 9.x versions prior to 9.0.35-3.39.1 on SLES 12-SP4 and 12-SP5
• Tomcat 9.x versions prior to 9.0.35-3.57.3 on SLES 15-based systems

Attack Vector

The attack requires local access to the system and membership in the tomcat group. An attacker with these prerequisites can exploit the misconfigured permissions to modify Tomcat configuration files, startup scripts, or related components. By injecting malicious code into these files, the attacker can achieve code execution with elevated privileges when the Tomcat service is restarted or when the system boots.

The exploitation flow typically involves:

1. Identifying writable files owned by root but group-writable to tomcat
2. Modifying startup scripts or configuration files to include malicious commands
3. Waiting for a service restart or triggering one
4. Gaining root-level command execution

This is a classic privilege escalation pattern where misconfigured file permissions create an unintended path from a limited user context to full system control.

Detection Methods for CVE-2020-8022

Indicators of Compromise

• Unexpected modifications to Tomcat configuration files such as server.xml, catalina.sh, or setenv.sh
• Changes to file permissions or ownership within the Tomcat installation directory
• Suspicious processes spawned by the tomcat user with elevated privileges
• Unusual entries in Tomcat startup or shutdown scripts

Detection Strategies

• Audit file permissions within /usr/share/tomcat, /etc/tomcat, and /var/log/tomcat directories for group-writable files
• Monitor system logs for privilege escalation attempts or unexpected root process spawning from tomcat contexts
• Implement file integrity monitoring (FIM) on critical Tomcat configuration and startup files
• Review user group memberships to identify unauthorized additions to the tomcat group

Monitoring Recommendations

• Enable auditd rules to track file modifications in Tomcat-related directories
• Configure SIEM alerts for process execution patterns indicating privilege escalation from tomcat to root
• Regularly audit group memberships and user permissions on affected systems
• Monitor package manager logs for Tomcat update activities to ensure patches are applied

How to Mitigate CVE-2020-8022

Immediate Actions Required

• Update affected Tomcat packages to the patched versions immediately
• Audit current file permissions on Tomcat directories and correct any overly permissive settings
• Review tomcat group membership and remove unnecessary users
• Consider temporarily restricting tomcat group access until patches are applied

Patch Information

SUSE has released patched versions of the Tomcat packages that correct the permission issues. Organizations should update to the following minimum versions:

• SLES 12-SP2/SP3, OpenStack Cloud 7/8, Crowbar 8, Enterprise Storage 5: Tomcat 8.0.53-29.32.1 or later
• SLES 12-SP4/SP5: Tomcat 9.0.35-3.39.1 or later
• SLES 15-LTSS, SLES for SAP 15: Tomcat 9.0.35-3.57.3 or later

Refer to the openSUSE Security Announcement and SUSE Bug Report #1172405 for detailed patch information and advisories.

Workarounds

• Manually audit and correct file permissions on Tomcat-related files, ensuring group-writable permissions are removed from sensitive files
• Restrict membership in the tomcat group to only essential service accounts
• Implement mandatory access control (MAC) policies using AppArmor or SELinux to limit what the tomcat user can access
• Consider running Tomcat in a containerized environment to limit the impact of privilege escalation

# Check for incorrect permissions on Tomcat files
find /usr/share/tomcat /etc/tomcat -type f -perm -g=w -ls

# Remove group write permissions from Tomcat startup scripts
chmod g-w /usr/share/tomcat/bin/*.sh

# Verify tomcat group membership
getent group tomcat

# Update Tomcat packages on SUSE systems
zypper update tomcat