CVE-2021-30640 Overview
CVE-2021-30640 is an authentication bypass vulnerability in the JNDI Realm component of Apache Tomcat. This flaw allows an attacker to authenticate using variations of a valid username and/or bypass some of the protection mechanisms provided by the LockOut Realm. The vulnerability stems from improper encoding or escaping of output (CWE-116) within the JNDI Realm authentication process.
Critical Impact
Attackers can potentially bypass authentication controls and account lockout protections, gaining unauthorized access to protected resources on vulnerable Apache Tomcat servers.
Affected Products
- Apache Tomcat 10.0.0-M1 to 10.0.5
- Apache Tomcat 9.0.0.M1 to 9.0.45
- Apache Tomcat 8.5.0 to 8.5.65
- Oracle Communications Cloud Native Core Policy 1.14.0
- Oracle Communications Diameter Signaling Router
- Oracle Communications Pricing Design Center 12.0.0.3.0
- Oracle Hospitality Cruise Shipboard Property Management System 20.1.0
- Oracle Tekelec Platform Distribution
- Debian Linux 9.0, 10.0, 11.0
Discovery Timeline
- July 12, 2021 - CVE-2021-30640 published to NVD
- November 21, 2024 - Last updated in NVD database
Technical Details for CVE-2021-30640
Vulnerability Analysis
The vulnerability exists within the JNDI Realm authentication mechanism of Apache Tomcat. The JNDI Realm is responsible for authenticating users against a directory service such as LDAP. Due to improper output encoding or escaping, attackers can manipulate username inputs to bypass authentication checks.
The flaw allows attackers to authenticate using variations of valid usernames. This occurs because the JNDI Realm does not properly normalize or sanitize username inputs before performing authentication queries against the backend directory service. As a result, character encoding variations or special characters in usernames may be interpreted differently, allowing unauthorized authentication.
Additionally, this vulnerability enables bypassing protections provided by the LockOut Realm. The LockOut Realm is designed to prevent brute-force attacks by locking accounts after a configurable number of failed authentication attempts. However, by using username variations, an attacker can effectively circumvent this protection, as each variation may be treated as a distinct user, resetting the failed attempt counter.
Root Cause
The root cause is classified as CWE-116 (Improper Encoding or Escaping of Output). The JNDI Realm component fails to properly encode or normalize usernames before using them in authentication queries. This allows specially crafted username variations to bypass expected authentication and lockout behaviors.
When usernames are passed to the JNDI directory service, variations in character encoding, case sensitivity handling, or special character interpretation can result in different authentication outcomes than expected. The lack of proper input normalization creates an inconsistency between how the LockOut Realm tracks failed attempts and how the JNDI Realm validates credentials.
Attack Vector
The attack is network-based and does not require prior authentication. An attacker can exploit this vulnerability by:
- Identifying a valid username on the target Tomcat application using JNDI Realm authentication
- Crafting variations of the username using different character encodings, case variations, or special characters
- Attempting authentication with these variations to bypass normal authentication or lockout mechanisms
- Gaining unauthorized access to protected resources or avoiding account lockout during brute-force attempts
The vulnerability requires high attack complexity due to the need for specific conditions: the target must use JNDI Realm for authentication, and the attacker needs knowledge of valid usernames and the ability to craft effective variations.
Detection Methods for CVE-2021-30640
Indicators of Compromise
- Multiple failed authentication attempts from the same source IP with slight variations in usernames
- Successful authentication events preceded by numerous failed attempts using similar but not identical usernames
- Unusual patterns in JNDI/LDAP query logs showing username variations or encoding anomalies
- Authentication bypass events where users authenticate without triggering expected lockout thresholds
Detection Strategies
- Monitor authentication logs for patterns indicating username manipulation or encoding variations
- Implement logging at the JNDI Realm level to capture raw authentication requests before normalization
- Configure Web Application Firewalls (WAF) to detect and alert on suspicious username patterns
- Deploy SIEM rules to correlate authentication attempts across username variations from the same source
Monitoring Recommendations
- Enable verbose logging for Apache Tomcat's authentication subsystem, particularly the JNDI Realm component
- Monitor for an increase in failed authentication attempts that do not trigger LockOut Realm protections
- Review LDAP directory service logs for unusual query patterns or authentication attempts
- Implement network-level monitoring to detect authentication brute-force attempts targeting Tomcat applications
How to Mitigate CVE-2021-30640
Immediate Actions Required
- Upgrade Apache Tomcat to version 10.0.6 or later, 9.0.46 or later, or 8.5.66 or later
- Review and audit current JNDI Realm configurations for potential exposure
- Implement additional authentication controls such as multi-factor authentication where possible
- Consider temporarily disabling JNDI Realm in favor of alternative authentication mechanisms if immediate patching is not possible
Patch Information
Apache has released security patches addressing this vulnerability. Organizations should upgrade to the following versions:
- Apache Tomcat 10.x: Upgrade to version 10.0.6 or later
- Apache Tomcat 9.x: Upgrade to version 9.0.46 or later
- Apache Tomcat 8.5.x: Upgrade to version 8.5.66 or later
For downstream products, refer to vendor-specific advisories:
- Oracle CPU January 2022 Security Alert
- Oracle CPU October 2021 Security Alert
- Debian DSA-4952 Security Notice
- Debian DSA-4986 Security Notice
Workarounds
- If using JNDI Realm with LDAP, implement server-side username normalization at the directory service level
- Configure additional input validation at the application layer to reject malformed or encoded usernames
- Implement rate limiting at the network or application level to reduce the effectiveness of brute-force attempts
- Consider using alternative Realm implementations such as DataSourceRealm or MemoryRealm until patching is complete
# Example: Verify Apache Tomcat version to confirm patch status
cd $CATALINA_HOME
./bin/version.sh
# Check for vulnerable versions and plan upgrade accordingly
# Affected: 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, 8.5.0 to 8.5.65
# Patched: 10.0.6+, 9.0.46+, 8.5.66+
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
