CVE-2011-2481 in Tomcat
Summary
by MITRE
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/12/2025
Apache Tomcat vulnerability CVE-2011-2481 represents a critical security flaw in the web application server's XML parser handling mechanism that enables cross-application privilege escalation. This vulnerability specifically affects Apache Tomcat versions 7.0.x prior to 7.0.17 and stems from a regression introduced by CVE-2009-0783, demonstrating how security fixes can inadvertently create new attack vectors. The flaw occurs due to improper class loading isolation between web applications, allowing malicious applications to manipulate the XML parser instance that is shared across multiple applications within the same Tomcat instance.
The technical implementation of this vulnerability exploits the shared XML parser resource within Tomcat's application container. When multiple web applications are deployed on the same Tomcat instance, they typically share common libraries and resources including XML parsing capabilities. The vulnerability arises because the XML parser configuration can be overridden by one application, affecting all subsequent applications that rely on the same parser instance. This creates a scenario where a malicious web application loaded earlier in the deployment order can modify the parser's behavior to access or modify configuration files from other applications. The affected files include web.xml which defines application servlet mappings and security constraints, context.xml which contains application context information and resource configurations, and tld files which define tag libraries for JSP pages.
The operational impact of this vulnerability is severe as it allows local attackers with access to deploy applications to potentially read or modify sensitive configuration files of other applications. An attacker could extract database connection details, security configurations, or other sensitive application parameters from the web.xml and context.xml files. Additionally, the ability to modify these files could lead to privilege escalation, application compromise, or even complete system takeover. The vulnerability is particularly dangerous in multi-tenant environments where multiple applications from different organizations share the same Tomcat instance, as it breaks the fundamental security isolation expected between applications.
This vulnerability maps to CWE-276, which describes inadequate privileges and permissions, and aligns with ATT&CK technique T1059.007 for application deployment, where adversaries establish persistence and maintain access through legitimate application deployment mechanisms. The attack vector is classified as local privilege escalation through application deployment, as it requires an attacker to have the ability to deploy malicious applications to the target system. Mitigation strategies include upgrading to Tomcat 7.0.17 or later versions where the regression has been addressed, implementing proper application isolation through separate Tomcat instances or containers, and employing strict deployment controls to prevent unauthorized application deployment. Organizations should also consider implementing application whitelisting policies and monitoring for unusual XML parser configuration changes within their Tomcat environments.