CVE-2020-1938: Ghostcat - Apache Tomcat AJP File Read/Inclusion Vulnerability (CNVD-2020-10487)
Several proof-of-concept exploit scripts for recently patched flaw in Apache Tomcat are now available.
Antecedentes
On February 20, China National Vulnerability Database (CNVD) published a security advisory for CNVD-2020-10487, a severe vulnerability in Apache Tomcat’s Apache JServ Protocol (or AJP). AJP is a binary protocol designed to handle requests sent to a web server destined for an application server in order to improve performance.
Ghostcat logo created by Chaitin Tech
The vulnerability, dubbed Ghostcat, was discovered by researchers at Chaitin Tech and reported to the Apache Software Foundation on January 3, 2020.
Análisis
CVE-2020-1938 is a file read/inclusion vulnerability in the AJP connector in Apache Tomcat. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (RCE).
Because AJP is enabled by default in the /conf/server.xml file in Apache Tomcat 6, 7, 8 and 9, all unpatched versions of Tomcat are vulnerable to Ghostcat.
Research community investigates
Apache Tomcat AJP Vulnerability (CNVD-2020-10487/CVE-2020-1938 ) .This vulnerability was discovered by a security researcher of Chaitin Tech .
You can read any webapps files or include a file to RCE .JUST A POC-GIF with no DETAILS
Tomcat has fix this vulnerability ,UPDATE! pic.twitter.com/Jauc5zPF3a— Henry Chen (@chybeta) February 20, 2020
Henry Chen, a security researcher at Alibaba Cloud, published a tweet confirming that exploiting the vulnerability would allow someone to “read any webapps files or include a file to RCE.” Chen shared a GIF showing the successful exploitation of the vulnerability.
just for clarify: CVE-2020-1938 is NOT a default Remote Code Execution vul. It is a LFI. So, IF you can:
1) upload files via an APP feature &
2) these files are saved inside the document root (eg. webapps/APP/... &
3) reach the AJP port directly;
Thus, it can be turned in RCE.— Joao Matos (@joaomatosf) February 21, 2020
Another security researcher, Joao Matos, confirmed that RCE is possible in cases where uploading files is a “feature,” that the uploaded files are “saved inside the document root,” and the AJP port can be reached directly.
Potential impact
According to a post in the Apache Software Foundation Blog from 2010, Apache Tomcat has been downloaded over 10 million times. Apache Tomcat is used by a variety of software applications, often bundled as an embedded web server. The potential impact of this vulnerability is wide, though we do not have the complete picture as of yet. As this information is still fresh, we anticipate additional details about its impact will become public in the coming weeks and months.
Prueba de concepto
Since the security advisory was published, several researchers have shared proof-of-concept exploit scripts [1, 2, 3, 4, 5] to GitHub.
Solución
Patch availability
Apache has released patches for several versions of Tomcat.
| Apache Version | Affected Release Versions | Fixed Version |
|---|---|---|
| Apache Tomcat 9 | 9.0.30 and below | 9.0.31 |
| Apache Tomcat 8 | 8.5.50 and below | 8.5.51 |
| Apache Tomcat 7 | 7.0.99 and below | 7.0.100 |
This vulnerability also reportedly affects Apache Tomcat 6, but Apache has not released a patch, as it is likely no longer supported. Users are strongly encouraged to upgrade to a newer version of Tomcat to ensure they’re protected against this vulnerability.
Mitigación
If patching is not feasible at this time, there are a few mitigation steps suggested by Chaitin Tech that can be taken to prevent exploitation of this vulnerability, since the AJP Connector is enabled by default.
If your site is not actively using the AJP Connector, simply comment it out from the /conf/server.xml file:
However, if you are using the AJP Connector on your site, you’ll need to ensure the AJP Connector contains the requiredSecret attribute, which is akin to a password, so it needs to be strong and unique.
UPDATE 02/23/2020: The above section has been updated to reference the correct attribute, requiredSecret.
Identificación de los sistemas afectados
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Obtenga más información
- Chaitin Tech's Ghostcat Page
- CNVD Security Advisory for CVE-2020-1938 (CNVD-2020-10487)
- Apache Tomcat 9.0 Changelog
- Apache Tomcat 8.5 Changelog
- Apache Tomcat 7.0 Changelog
Únase al Equipo de respuesta de seguridad de Tenable en Tenable Community.
Obtenga más información sobre Tenable, la primera plataforma de Cyber Exposure para el control integral de la superficie de ataque moderna.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Artículos relacionados
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Cybersecurity Snapshot: Cyber Agencies Offer Secure AI Tips, while Stanford Issues In-Depth AI Trends Analysis, Including of AI Security
April 19, 2024Check out recommendations for securing AI systems from the Five Eyes cybersecurity agencies. Plus, Stanford University offers a comprehensive review of AI trends. Meanwhile, a new open-source tool aims to simplify SBOM usage. And don’t miss the latest CIS Benchmarks updates. And much more!
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
- Vulnerability Management