CVE-2024-6162: Undertow AJP Listener DoS Vulnerability

CVE-2024-6162 Overview

A race condition vulnerability was discovered in Undertow, Red Hat's high-performance web server written in Java, where URL-encoded request paths can be mishandled during concurrent requests on the AJP (Apache JServ Protocol) listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures that can render legitimate resources inaccessible.

Critical Impact

This vulnerability enables remote attackers to cause denial of service conditions by exploiting buffer reuse during concurrent AJP requests, leading to path mix-ups that prevent legitimate access to web resources.

Affected Products

• Undertow (AJP Listener component)
• Red Hat JBoss Enterprise Application Platform
• Products utilizing Undertow's AJP listener functionality

Discovery Timeline

• 2024-06-20 - CVE CVE-2024-6162 published to NVD
• 2024-11-29 - Last updated in NVD database

Technical Details for CVE-2024-6162

Vulnerability Analysis

The vulnerability exists within Undertow's AJP listener implementation, specifically in how URL-encoded request paths are decoded during concurrent request processing. The root issue stems from improper resource locking (CWE-400: Uncontrolled Resource Consumption), where a shared buffer is utilized across multiple simultaneous requests without adequate synchronization mechanisms.

When multiple AJP requests arrive concurrently, each request's URL-encoded path gets decoded using the same buffer. Without proper isolation between concurrent operations, the decoded path data from one request can overwrite or intermix with data from another request. This race condition causes the server to process incorrect path information, leading to requests being routed to unintended resources.

The practical impact is significant: legitimate user requests may receive "404 Not Found" errors or be directed to incorrect application endpoints, effectively causing a denial of service condition. The vulnerability can be exploited remotely without authentication, and no user interaction is required to trigger the flaw.

Root Cause

The vulnerability originates from inadequate thread safety in Undertow's AJP path decoding mechanism. The shared buffer used for URL decoding lacks proper synchronization primitives, creating a Time-of-Check Time-of-Use (TOCTOU) race condition when multiple threads simultaneously process incoming AJP requests. This design flaw allows concurrent write operations to corrupt the path data intended for individual requests.

Attack Vector

The attack exploits the network-accessible AJP listener by sending a high volume of concurrent requests with URL-encoded paths. An attacker can trigger the race condition remotely without requiring any privileges or user interaction.

The exploitation mechanism works as follows:

1. The attacker identifies a target server running Undertow with an exposed AJP listener (typically on port 8009)
2. Multiple concurrent HTTP requests are sent through the AJP protocol with varying URL-encoded paths
3. The shared buffer race condition causes path data corruption between concurrent requests
4. Legitimate requests begin receiving 404 errors or incorrect responses as paths are misrouted
5. Continued exploitation maintains the denial of service condition

This vulnerability does not require sophisticated exploitation techniques—high-volume concurrent requests are sufficient to trigger the race condition and degrade service availability.

Detection Methods for CVE-2024-6162

Indicators of Compromise

• Unexpected spike in HTTP 404 errors in application logs without corresponding changes to application routing
• AJP listener log entries showing path mismatches between requested and processed URLs
• User reports of intermittent access failures to legitimate application resources
• High concurrent connection counts on AJP listener ports (typically port 8009)

Detection Strategies

• Monitor application logs for unusual patterns of 404 errors, particularly during periods of high concurrent traffic
• Implement network monitoring to detect abnormal traffic volumes targeting AJP listener ports
• Deploy application performance monitoring (APM) to identify request routing anomalies and path resolution failures
• Review Undertow access logs for path inconsistencies between client requests and server-processed paths

Monitoring Recommendations

• Configure alerting thresholds for 404 error rates that exceed normal operational baselines
• Implement connection rate limiting on AJP listener ports to detect and mitigate exploitation attempts
• Enable detailed request logging on Undertow to capture URL-encoded paths before and after decoding
• Monitor JVM thread contention metrics that may indicate race condition exploitation

How to Mitigate CVE-2024-6162

Immediate Actions Required

• Apply the latest security patches from Red Hat or your Undertow distribution immediately
• If patching is not immediately possible, consider temporarily disabling the AJP listener if HTTP/HTTPS alternatives are available
• Implement network-level restrictions to limit AJP listener access to trusted sources only
• Review and restrict which systems can connect to AJP listener ports using firewall rules

Patch Information

Red Hat has released security advisories addressing this vulnerability. Organizations should apply the appropriate patches based on their deployment:

• Red Hat Security Advisory RHSA-2024:1194
• Red Hat Security Advisory RHSA-2024:4386
• Red Hat Security Advisory RHSA-2024:4884

Additional vendor advisories are available from NetApp Security Advisory ntap-20241129-0009. For detailed technical information, refer to Red Hat Bugzilla Report #2293069 and Red Hat JIRA Issue JBEAP-26268.

Workarounds

• Disable the AJP listener entirely if not required and switch to HTTP/HTTPS connectors
• Implement rate limiting on AJP connections to reduce the likelihood of triggering the race condition
• Deploy a reverse proxy or load balancer in front of the AJP listener to control and throttle incoming connections
• Use network segmentation to restrict AJP listener access to only essential internal services

# Example: Disable AJP listener in standalone.xml configuration
# Locate and comment out or remove the AJP listener configuration
# Before applying, ensure HTTP/HTTPS connectors are properly configured

# In JBoss/WildFly standalone.xml, remove or comment the AJP listener:
# <ajp-listener name="ajp" socket-binding="ajp"/>

# Alternatively, restrict AJP access via iptables
iptables -A INPUT -p tcp --dport 8009 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8009 -j DROP