CVE-2022-29885: Apache Tomcat DoS Vulnerability

CVE-2022-29885 Overview

CVE-2022-29885 is a documentation vulnerability affecting Apache Tomcat's EncryptInterceptor component. The documentation incorrectly stated that the EncryptInterceptor enabled Tomcat clustering to run securely over untrusted networks. While the EncryptInterceptor does provide confidentiality and integrity protection for cluster communications, it does not protect against all risks associated with running over untrusted networks—particularly Denial of Service (DoS) attacks. Organizations relying on this documentation guidance may have deployed Tomcat clusters in insecure configurations, exposing them to potential service disruption.

Critical Impact

Apache Tomcat deployments using EncryptInterceptor for cluster communications over untrusted networks are vulnerable to DoS attacks, potentially causing complete service unavailability.

Affected Products

• Apache Tomcat 10.1.0-M1 to 10.1.0-M14
• Apache Tomcat 10.0.0-M1 to 10.0.20
• Apache Tomcat 9.0.13 to 9.0.62
• Apache Tomcat 8.5.38 to 8.5.78
• Debian Linux 10.0 and 11.0
• Oracle Hospitality Cruise Shipboard Property Management System 20.2.1

Discovery Timeline

• 2022-05-12 - CVE-2022-29885 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-29885

Vulnerability Analysis

This vulnerability stems from misleading documentation rather than a code flaw. The Apache Tomcat documentation for versions spanning major releases (8.5.x, 9.0.x, 10.0.x, and 10.1.x milestones) incorrectly described the security guarantees of the EncryptInterceptor component used in Tomcat clustering configurations. The documentation led administrators to believe that enabling EncryptInterceptor was sufficient to secure cluster communications over untrusted networks, such as the public internet or shared network infrastructure.

The EncryptInterceptor provides encryption for inter-node communications within a Tomcat cluster, ensuring confidentiality of data in transit and integrity verification to detect tampering. However, this protection operates at the application layer and does not address network-layer attack vectors. An attacker with network access to the cluster can still flood cluster nodes with malformed or excessive traffic, consuming resources and degrading or disrupting service availability.

Root Cause

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption). While the EncryptInterceptor correctly implements cryptographic protections, the underlying cluster communication mechanism lacks adequate rate limiting, connection throttling, or other DoS mitigation controls. The misleading documentation compounded this technical limitation by encouraging deployments that assumed complete network security was provided.

The fundamental issue is that encryption alone cannot prevent resource exhaustion attacks. An attacker does not need to decrypt or forge valid messages—simply sending a high volume of traffic to cluster ports can overwhelm the processing capacity of Tomcat nodes, regardless of whether the encrypted channel rejects the invalid data.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker positioned on the same network as Tomcat cluster nodes—or able to route traffic to cluster communication ports—can exploit this vulnerability.

The attack mechanism involves flooding Tomcat cluster nodes with network traffic targeting the cluster communication channels. This can manifest in several ways:

The attacker sends a high volume of connection requests to cluster ports, exhausting socket resources and preventing legitimate cluster members from communicating. Alternatively, the attacker sends malformed encrypted payloads that force the EncryptInterceptor to expend CPU cycles attempting decryption before ultimately rejecting the invalid data. Even rejected requests consume processing resources, and at sufficient volume, can degrade cluster performance or cause node failures.

Organizations that deployed Tomcat clusters over untrusted networks based on the documentation's assurances may have exposed cluster communication ports without additional network-level protections, making this attack vector readily accessible to remote attackers.

Detection Methods for CVE-2022-29885

Indicators of Compromise

• Unusual network traffic volume targeting Tomcat cluster communication ports (default TCP 4000-4100 range)
• Elevated CPU utilization on Tomcat nodes without corresponding increase in legitimate application traffic
• Cluster membership instability with nodes repeatedly joining and leaving the cluster
• Log entries indicating connection timeouts or failures between cluster members

Detection Strategies

• Monitor network traffic patterns for anomalous connection rates to Tomcat cluster ports
• Implement network intrusion detection rules to identify DoS traffic patterns targeting cluster endpoints
• Review Tomcat cluster configuration to identify deployments using EncryptInterceptor over untrusted network segments
• Audit infrastructure to determine if cluster communication ports are exposed to untrusted networks

Monitoring Recommendations

• Configure alerting on Tomcat cluster health metrics including membership changes and replication latency
• Establish baseline network traffic patterns for cluster communications and alert on significant deviations
• Monitor system resource utilization (CPU, memory, network sockets) on all cluster member nodes
• Enable detailed logging for cluster communication events to support forensic analysis

How to Mitigate CVE-2022-29885

Immediate Actions Required

• Review all Apache Tomcat cluster deployments to identify configurations relying on EncryptInterceptor over untrusted networks
• Implement network segmentation to restrict cluster communication to trusted, private network segments
• Deploy firewall rules limiting access to cluster communication ports to known cluster member IP addresses
• Upgrade Apache Tomcat to patched versions: 10.1.0-M15+, 10.0.21+, 9.0.63+, or 8.5.79+

Patch Information

Apache has released corrected documentation in subsequent versions clarifying the security limitations of the EncryptInterceptor. For full protection, upgrade to Apache Tomcat versions 10.1.0-M15 or later, 10.0.21 or later, 9.0.63 or later, or 8.5.79 or later. Vendor-specific patches are also available through Debian Security Advisory DSA-5265 and the Oracle Critical Patch Update July 2022 for affected Oracle products. Additional information is available in the Apache Security Mailing List Post.

Workarounds

• Relocate Tomcat cluster traffic to isolated, trusted network segments not accessible from untrusted sources
• Implement IPsec or VPN tunnels for all cluster communication traffic when trusted network segments are unavailable
• Deploy network-layer rate limiting and connection throttling on cluster communication ports
• Configure firewall rules to whitelist only specific cluster member IP addresses for inter-node communication

# Example iptables rules to restrict cluster communication
# Replace with actual cluster member IPs
CLUSTER_MEMBERS="192.168.1.10 192.168.1.11 192.168.1.12"
CLUSTER_PORT_START=4000
CLUSTER_PORT_END=4100

for ip in $CLUSTER_MEMBERS; do
  iptables -A INPUT -p tcp -s $ip --dport $CLUSTER_PORT_START:$CLUSTER_PORT_END -j ACCEPT
done

# Drop all other traffic to cluster ports
iptables -A INPUT -p tcp --dport $CLUSTER_PORT_START:$CLUSTER_PORT_END -j DROP