Experts warn of mass scans for Apache Tomcat Ghostcat flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1938 | Ghostcat (CVE-2020-1938): Unauthenticated File Read/JSP RCE via AJP in Apache Tomcat CVE-2020-1938 ('Ghostcat') is an improper privilege management flaw in Apache Tomcat's Apache JServ Protocol (AJP) connector, which shipped enabled by default listening on all interfaces (typically port 8009) in Tomcat 9.0.0.M1-9.0.0.30, 8.5.0-8.5.50 and 7.0.0-7.0.99, and which treats AJP connections as far more trusted than equivalent HTTP connections. An attacker who can reach the AJP port without authentication can inject crafted AJP attributes to make Tomcat return arbitrary files from anywhere in the web application or process any file in the web application as JSP. If the application allows file uploads stored within the web application (or the attacker can otherwise control file content), this escalates to unauthenticated remote code execution. Exposure is conditional: only deployments where the AJP port is reachable by untrusted users are at risk, but Tomcat's very large installed base, including vendor bundles from Oracle, NetApp, Debian, openSUSE, Fedora and BlackBerry, means many hundreds of thousands of systems are potentially affected. The flaw is known to be exploited: it was added to CISA's KEV on 2022-03-03, EPSS estimates a 99.3% probability of exploitation within 30 days (100th percentile), and mass scanning of exposed Tomcat AJP ports was publicly reported. Do: Upgrade to Apache Tomcat 9.0.31, 8.5.51, or 7.0.100 or later, noting that the hardened default AJP connector configuration in these releases may require small configuration changes after upgrade. If you cannot upgrade, disable the AJP connector if unused, or bind it to localhost/restrict firewall access so port 8009 is not reachable by untrusted users. Check whether the AJP port is exposed to the internet and whether any web application allows file uploads into the web application directory, since that is what converts file read into remote code execution. | 9.8 | 99% | KEV PoC |
| masshundreds of thousands of internet-exposed Tomcat AJP endpoints (order of magnitude: 100,000+ exposed systems) |
Full article445 words · extracted from securityaffairs.com · click to collapse
Experts warn of ongoing scans for Apache Tomcat servers affected by the Ghostcat flaw that could allow attackers to take over servers.
Security experts are warning of ongoing scans for Apache Tomcat servers affected by the recently disclosed Ghostcat vulnerability CVE-2020-1938.
The flaw affects all versions of Apache Tomcat, it could be exploited by attackers to read configuration files or install backdoors on vulnerable servers.
The vulnerability affects the Tomcat AJP protocol and was discovered by the Chinese cybersecurity firm Chaitin Tech, it could potentially allow attackers to take over vulnerable servers.
During the weekend, Bad Packets researchers reported an ongoing mass scanning for this flaw.
https://twitter.com/bad_packets/status/1233900872159002624
“Ghostcat is a serious vulnerability in Tomcat discovered by security researcher of Chaitin Tech. Due to a flaw in the Tomcat AJP protocol, an attacker can read or include any files in the webapp directories of Tomcat.” states the website set up to describe the issue. “For example, An attacker can read the webapp configuration files or source code. In addition, if the target web application has a file upload function, the attacker may execute malicious code on the target host by exploiting file inclusion through Ghostcat vulnerability.”
Tomcat Connector allows Tomcat to connect to the outside, it enables Catalina to receive requests from the outside, pass them to the corresponding web application for processing, and return the response result of the request.
By default, Tomcat used two Connectors, the HTTP Connector and the AJP Connector, the latter listens on the server’s port 8009.
The Ghostcat vulnerability in the AJP that can be exploited to either read or write files to a Tomcat server, an attacker could trigger the flaw to access configuration files and steal passwords or API tokens. It can also allow attackers to write files to a server, including malware or web shells.
Tomcat versions affected by the Ghostcat vulnerability are:
- Apache Tomcat 9.x < 9.0.31
- Apache Tomcat 8.x < 8.5.51
- Apache Tomcat 7.x < 7.0.100
- Apache Tomcat 6.x
Security patches were already released for Tomcat 7.x, Tomcat 8.x, and Tomcat 9.x, Chaitin experts also released an update to their XRAY scanner to find vulnerable Tomcat servers.
Immediately after the public disclosure of the Ghostcat issue, several experts have shared proof-of-concept exploit scripts [1, 2, 3, 4, 5] to GitHub.
Researchers at Chaitin Tech also released a tool that could be exploited to find Tomcat servers vulnerable to the Ghostcat flaw.
Querying Shodan for Tomcat servers exposed online, we can find over 900,000 installs, but only above versions are vulnerable.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Ghostcat)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/98830/hacking/ghostcat-mass-scanning.html