Example Analysis of the recurrence of Ajp File Reading vulnerabilities in Tomcat
Editor to share with you the Tomcat Ajp file reading vulnerabilities recurrence of the example analysis, I believe that most people do not understand, so share this article for your reference, I hope you will learn a lot after reading this article, let's go to understand it!
Brief introduction of vulnerabilities
Due to a file inclusion flaw in the AJP service (port 8009) enabled by Tomcat by default, an attacker can construct a malicious request packet for file inclusion operation to read the Web directory file on the affected Tomcat server.
Https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1938
Scope of influence
Apache Tomcat 6
Apache Tomcat 7 < 7.0.100
Apache Tomcat 8 < 8.5.51
Apache Tomcat 9 < 9.0.31
1. Install the docker environment first
1.1 apt-get update
1.2 apt-get install-y apt-transport-https ca-certificates
1.3 apt-get install dirmngr
1.4 curl-fsSL https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/debian/gpg | sudo apt-key add-
1.5 echo 'deb https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/debian/ buster stable' | sudo tee / etc/apt/sources.list.d/docker.list
1.6 apt-get update
1.7 apt install docker-ce
1.8 service docker status~
1.9 service docker status
2.0 service docker start
2.1 service docker version
2.2 docker version
2.3 docker run hello-world
Environment building:
Download image docker pull negoowen/ghostcat:1.0
Start mirroring
Docker run-d-p 8080 8080-p 8009 8009-- name ghostcat negoowen/ghostcat:1.0
Loophole recurrence
Read a file
A test.txt file has been written into the image and tested with this file
Python CVE-2020-1938.py-p 8009-f test.txt 192.168.195.133
Repair suggestion
1. Official upgrade
Apache Tomcat 7.0.100
Apache Tomcat 8.5.51
Apache Tomcat 9.0.31
two。 Turn off AJP and open the port by default (8009 here) or listen locally only
The above is all the contents of this article entitled "sample Analysis of the recurrence of Ajp File Reading vulnerabilities in Tomcat". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!
