immediately install the latest available version of the server
application to prevent hackers from taking unauthorized control
over it.
Yes, that’s possible because all versions (9.x/8.x/7.x/6.x) of
the Apache Tomcat released in the past 13 years have been found
vulnerable to a new high-severity ‘file read and
inclusion bug[1]‘—which can be exploited
in the default configuration.
But it’s more concerning because several proof-of-concept
exploits (1, 2,
3, 4) for this vulnerability have also been surfaced on
the Internet, making it easy for anyone to hack into publicly
accessible vulnerable web servers.
Dubbed ‘Ghostcat‘ and tracked as CVE-2020-1938, the
flaw could let unauthenticated, remote attackers read the content
of any file on a vulnerable web server and obtain sensitive
configuration files or source code, or execute arbitrary code if
the server allows file upload, as shown in a demo[2] below.
What is Ghostcat Flaw And How Does it Work?
According to Chinese cybersecurity company Chaitin Tech[3], the vulnerability
resides in the AJP protocol of Apache Tomcat software that arises
due to improper handling of an attribute.
“If the site allows users upload file, an attacker can first upload
a file containing malicious JSP script code to the server (the
uploaded file itself can be of any filetype, such as pictures,
plain text files, etc.), and then include the uploaded file by
exploiting the Ghostcat, which finally can result in remote code
execution,” the researchers said.
version of the HTTP protocol to allow Tomcat to communicate with an
Apache web-server.
port 8009, it is bound to IP address 0.0.0.0 and can only be
exploited remotely when accessible to untrusted clients.
According to ‘onyphe,’ a search engine for open-source and cyber
threat intelligence data, there are more than 170,000
devices[4] that are exposing an AJP
Connector to everyone through the Internet, at the time of writing.
Apache Tomcat Vulnerability: Patch and Mitigation
Chaitin researchers found and reported this flaw last month to the
Apache Tomcat project, who has now released Apache Tomcat 9.0.31[5], 8.5.51, and 7.0.100
versions to patch the issue.
The latest releases also fix 2 other low severity HTTP request
smuggling (CVE-2020-1935 and CVE-2019-17569) issues.
Web administrators are strongly recommended to apply the
software updates as soon as possible and advised to never expose
AJP port to untrusted clients because it communicates over the
insecure channel and meant to be used within a trusted network.
“Users should note that a number of changes were made to the
default AJP Connector configuration in 9.0.31 to harden the default
configuration. It is likely that users upgrading to 9.0.31 or later
will need to make small changes to their configurations as a
result,” the Tomcat team said.
server immediately, you can also disable the AJP Connector
directly, or change its listening address to the
localhost.
References
- ^
file read and inclusion bug
(lists.apache.org) - ^
demo
(twitter.com) - ^
Chaitin Tech
(www.chaitin.cn) - ^
170,000 devices
(twitter.com) - ^
Apache Tomcat 9.0.31
(tomcat.apache.org)