Ghostcat
- Product
- Apache Tomcat (AJP connector)
- CVE
- CVE-2020-1938
- Disclosed
- 2020-02-20
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Tomcat 9.0.0.M1-9.0.30, 8.5.0-8.5.50, 7.0.0-7.0.99 (and EOL 6.x) with the AJP connector enabled (default)
- Fixed
- 9.0.31, 8.5.51, 7.0.100
Summary
Chaitin Tech found that Tomcat's AJP connector, enabled by default on port 8009, trusted request attributes sent by the proxy. An attacker talking AJP directly could read any file in a web app (like WEB-INF/web.xml) or make Tomcat treat an uploaded file as a JSP, giving code execution.
Root cause
AJP lets the front-end proxy set arbitrary request attributes, and Tomcat trusted them without authentication. Setting javax.servlet.include.request_uri / path_info / servlet_path makes the default or JSP servlet serve or execute an arbitrary path inside the web app. The fix disabled AJP by default, bound it to localhost and required a secret.
Impact
Unauthenticated file read within web apps, and RCE when an attacker can place a file (e.g. via upload) that is then included as JSP.
Detection
Scan for exposed TCP 8009 (AJP13); check Tomcat version and server.xml for an AJP Connector without a secret. Nuclei template CVE-2020-1938.
Mitigation
Upgrade Tomcat; disable the AJP connector if unused, or bind it to localhost and set secretRequired/secret.