Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the provided patches reveals a logical flaw in the EncryptInterceptor's error handling. The vulnerability, as described, is a bypass of the encryption mechanism. The commits clearly show that the call to super.messageReceived(msg), which forwards the message to the next interceptor, was moved from outside the try-catch block to inside the try block. In the vulnerable state, a failure in decryption (a GeneralSecurityException) would be caught, but the code would proceed to call super.messageReceived(msg) with the original, encrypted (or malformed) message. This would cause the message to be processed without proper decryption, effectively bypassing the security control. The identified vulnerable function, org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.messageReceived, is the exact location of this flawed logic. An exploit would involve sending a message that triggers this exception, causing the unencrypted payload to be processed, which would be visible in a runtime profile as a call to this function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | = 11.0.20 | 11.0.21 |
| org.apache.tomcat:tomcat | maven | = 10.1.53 | 10.1.54 |
| org.apache.tomcat:tomcat | maven | = 9.0.116 | 9.0.117 |
| org.apache.tomcat:tomcat-tribes | maven | = 11.0.20 | 11.0.21 |
| org.apache.tomcat:tomcat-tribes | maven | = 10.1.53 | 10.1.54 |
| org.apache.tomcat:tomcat-tribes | maven | = 9.0.116 | 9.0.117 |
