CVE-2022-25762: Response mix-up with WebSocket concurrent send and close
Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by improper error handling in WebSocket connection. By sending a specially-crafted WebSocket message concurrently with the WebSocket connection closing, an attacker could exploit this vulnerability to continue to use the socket after it has been closed.
Other sources
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25762?
The severity of CVE-2022-25762 is high with a score of 8.6.
Which web applications are affected by CVE-2022-25762?
CVE-2022-25762 affects web applications running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20.
How does CVE-2022-25762 occur?
CVE-2022-25762 occurs when a web application sends a WebSocket message concurrently with the WebSocket connection closing.
What is the impact of CVE-2022-25762?
The impact of CVE-2022-25762 is that the application may continue to use the socket after it has been closed, leading to potential security vulnerabilities.
How can I fix CVE-2022-25762?
To fix CVE-2022-25762, it is recommended to upgrade to Apache Tomcat version 8.5.76 or 9.0.21, depending on the affected version.