Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2020-1938

Description

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

POC

Reference

- https://www.oracle.com/security-alerts/cpujan2021.html

- https://www.oracle.com/security-alerts/cpujul2020.html

- https://www.oracle.com/security-alerts/cpuoct2020.html

Github

- https://github.com/00theway/Ghostcat-CNVD-2020-10487

- https://github.com/02Manas-jha/Metasploitable-Nessus-Vulnerability-Assessment

- https://github.com/0day404/vulnerability-poc

- https://github.com/0day666/Vulnerability-verification

- https://github.com/0x783kb/Security-operation-book

- https://github.com/0xMrNiko/Awesome-Red-Teaming

- https://github.com/0xT11/CVE-POC

- https://github.com/0xdc10/tomghost-thm

- https://github.com/0xget/cve-2001-1473

- https://github.com/1120362990/vulnerability-list

- https://github.com/20142995/Goby

- https://github.com/20142995/nuclei-templates

- https://github.com/20142995/pocsuite3

- https://github.com/20142995/sectool

- https://github.com/5altNaCl/Backend-vulnerable-free-market-site

- https://github.com/5altNaCl/Vulnerable-flea-market-site

- https://github.com/ARPSyndicate/cve-scores

- https://github.com/ARPSyndicate/cvemon

- https://github.com/ARPSyndicate/kenzer-templates

- https://github.com/AfvanMoopen/tryhackme-

- https://github.com/AlexandeAbel/13-1

- https://github.com/Amar224/Pentest-Tools

- https://github.com/AnonVulc/Pentest-Tools

- https://github.com/Arhimason/wscan

- https://github.com/ArrestX/--POC

- https://github.com/CVEDB/PoC-List

- https://github.com/CVEDB/awesome-cve-repo

- https://github.com/CVEDB/top

- https://github.com/ChHsiching/GitHub-Chinese-Top-Charts

- https://github.com/CnHack3r/Penetration_PoC

- https://github.com/CodingChatRoom/Advance-Reconnaissance-

- https://github.com/Coldplay1517/Middleware-Vulnerability-detection-master

- https://github.com/CracksoftShlok/DirectoryTraversalWebSec

- https://github.com/CryptoJoyj/teaa

- https://github.com/DaemonShao/CVE-2020-1938

- https://github.com/Dzmitry-Basiachenka/dist-foreign-aliakh

- https://github.com/EchoGin404/-

- https://github.com/EchoGin404/gongkaishouji

- https://github.com/Esther7171/THM-Walkthroughs

- https://github.com/Esther7171/TryHackMe-Walkthroughs

- https://github.com/Francisco1915/Maquina-NOASPEN

- https://github.com/G1ngerCat/Tools_G1ngerCat

- https://github.com/GhostTroops/TOP

- https://github.com/H1CH444MREB0RN/PenTest-free-tools

- https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat

- https://github.com/Hatcat123/my_stars

- https://github.com/HimmelAward/Goby_POC

- https://github.com/I-Runtime-Error/CVE-2020-1938

- https://github.com/ImranTheThirdEye/AD-Pentesting-Tools

- https://github.com/InesMartins31/iot-cves

- https://github.com/J1ezds/Vulnerability-Wiki-page

- https://github.com/JERRY123S/all-poc

- https://github.com/JohanMV/vulnerability-analysis-lab

- https://github.com/JosephJMRG/apache-docker-project

- https://github.com/Joshua8821/CNVD

- https://github.com/Just1ceP4rtn3r/CVE-2020-1938-Tool

- https://github.com/KDRSMH/Zerone-week-3

- https://github.com/KarimLedesmaHaron/THM-Tutoriales

- https://github.com/KayCHENvip/vulnerability-poc

- https://github.com/LandGrey/ClassHound

- https://github.com/MateoSec/ghostcatch

- https://github.com/Mbilse/GitHub-Chinese-Top-Charts

- https://github.com/Mehedi-Babu/pentest_tools_repo

- https://github.com/MelanyRoob/Goby

- https://github.com/Miraitowa70/POC-Notes

- https://github.com/Mithlonde/Mithlonde

- https://github.com/Mr-xn/Penetration_Testing_POC

- https://github.com/MrPWH/Pentest-Tools

- https://github.com/NCSU-DANCE-Research-Group/CDL

- https://github.com/NaCl5alt/Backend-vulnerable-free-market-site

- https://github.com/Neko-chanQwQ/CVE-2020-1938

- https://github.com/NetW0rK1le3r/awesome-hacking-lists

- https://github.com/NyxAzrael/Goby_POC

- https://github.com/Ostorlab/KEV

- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors

- https://github.com/PuddinCat/GithubRepoSpider

- https://github.com/RanDomGuY84/OIBSIP

- https://github.com/S3cur3Th1sSh1t/My-starred-Repositories

- https://github.com/S3cur3Th1sSh1t/Pentest-Tools

- https://github.com/SexyBeast233/SecBooks

- https://github.com/Shadowven/Vulnerability_Reproduction

- https://github.com/Snowty/pocset

- https://github.com/TechnicalSR/Task-3-Perform-a-Basic-Vulnerability-Scan-on-Your-PC

- https://github.com/Threekiii/Awesome-Exploit

- https://github.com/Threekiii/Awesome-POC

- https://github.com/Threekiii/Awesome-Redteam

- https://github.com/Threekiii/Vulhub-Reproduce

- https://github.com/TrojanAZhen/Self_Back

- https://github.com/Tyro-Shan/gongkaishouji

- https://github.com/Umesh2807/Ghostcat

- https://github.com/V1sm4y/Tomghost-thm

- https://github.com/WHtig3r/CVE-2020-1938

- https://github.com/Warelock/cve-2020-1938

- https://github.com/Waseem27-art/ART-TOOLKIT

- https://github.com/XiaomingX/awesome-poc-for-red-team

- https://github.com/YIXINSHUWU/Penetration_Testing_POC

- https://github.com/Yamewrong/cve-lab

- https://github.com/YellowVeN0m/Pentesters-toolbox

- https://github.com/YounesTasra-R4z3rSw0rd/CVE-2020-1938

- https://github.com/Z0fhack/Goby_POC

- https://github.com/ZTK-009/Penetration_PoC

- https://github.com/ZTK-009/RedTeamer

- https://github.com/ZapcoMan/TomcatVulnToolkit

- https://github.com/Zaziki1337/Ghostcat-CVE-2020-1938

- https://github.com/Zero094/Vulnerability-verification

- https://github.com/abdullah89255/Advanced-Vulnerability-Scanning

- https://github.com/acodervic/CVE-2020-1938-MSF-MODULE

- https://github.com/aihuonaicha/tomcat

- https://github.com/alexandersimon/jboss-workshop

- https://github.com/angui0O/Awesome-Redteam

- https://github.com/apachecn-archive/Middleware-Vulnerability-detection

- https://github.com/asastillero/vuln-management-workflow

- https://github.com/b1cat/CVE_2020_1938_ajp_poc

- https://github.com/bakery312/Vulhub-Reproduce

- https://github.com/bash3rt3am/poc-cve

- https://github.com/beafn28/VulnSpy

- https://github.com/bhdresh/SnortRules

- https://github.com/bkfish/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner

- https://github.com/blue-duty/stars

- https://github.com/brunsu/woodswiki

- https://github.com/catsecorg/CatSec-TryHackMe-WriteUps

- https://github.com/chushuai/wscan

- https://github.com/cyberanand1337x/bug-bounty-2022

- https://github.com/d4n-sec/d4n-sec.github.io

- https://github.com/dacade/CVE-2020-1938

- https://github.com/dacade/CVE-POC

- https://github.com/delsadan/CNVD-2020-10487-Bulk-verification

- https://github.com/developer3000S/PoC-in-GitHub

- https://github.com/doggycheng/CNVD-2020-10487

- https://github.com/dusbot/cpe2cve

- https://github.com/duty9527/stars

- https://github.com/einzbernnn/CVE-2020-1938Scan

- https://github.com/einzbernnn/Tomcatscan

- https://github.com/elinakrmova/RedTeam-Tools

- https://github.com/emilywang0/CVE_testing_VULN

- https://github.com/emilywang0/MergeBase_test_vuln

- https://github.com/emtee40/win-pentest-tools

- https://github.com/enomothem/PenTestNote

- https://github.com/erickrr-bd/Apache-Tomcat-Ghostcat-Vulnerability

- https://github.com/euflen/ghostcatlfi

- https://github.com/fahimalshihab/Boot2Root

- https://github.com/fairyming/CVE-2020-1938

- https://github.com/fatal0/tomcat-cve-2020-1938-check

- https://github.com/fatlindisufistudenthogent/cyber-npe-opdracht

- https://github.com/feesec/CNVD-2020-10487-Tomcat-Ajp-lfi

- https://github.com/fengjixuchui/RedTeamer

- https://github.com/fofapro/vulfocus

- https://github.com/fotisnanossec/Vuln-Report-AI

- https://github.com/geleiaa/ceve-s

- https://github.com/gobysec/Goby

- https://github.com/goddemondemongod/Sec-Interview

- https://github.com/h7hac9/CVE-2020-1938

- https://github.com/hack-parthsharma/Pentest-Tools

- https://github.com/haerin7427/CVE_2020_1938

- https://github.com/hanc00l/some_pocsuite

- https://github.com/hasee2018/Penetration_Testing_POC

- https://github.com/hectorgie/PoC-in-GitHub

- https://github.com/hktalent/TOP

- https://github.com/hktalent/bug-bounty

- https://github.com/hopsypopsy8/CVE-2020-1938-Exploitation

- https://github.com/hopsypopsy8/hopsypopsy8

- https://github.com/huan-cdm/secure_tools_link

- https://github.com/huike007/penetration_poc

- https://github.com/huike007/poc

- https://github.com/huimzjty/vulwiki

- https://github.com/huisetiankong478/penetration_poc

- https://github.com/huisetiankong478/poc

- https://github.com/hwiwonl/dayone

- https://github.com/hxysaury/saury-vulnhub

- https://github.com/hypn0s/AJPy

- https://github.com/ilmila/J2EEScan

- https://github.com/infosectalha/Nessus_vulnerability_assessment

- https://github.com/intruderlabs/tomcatch

- https://github.com/jared1981/More-Pentest-Tools

- https://github.com/jbmihoub/all-poc

- https://github.com/jeansgit/Pentest

- https://github.com/jptr218/ghostcat

- https://github.com/kabaneridev/oscp-notes

- https://github.com/kaydenlsr/Awesome-Redteam

- https://github.com/kdandy/pentest_tools

- https://github.com/kevinLyon/TomGhost

- https://github.com/killvxk/Awesome-Exploit

- https://github.com/koala2099/GitHub-Chinese-Top-Charts

- https://github.com/kukudechen-chen/cve-2020-1938

- https://github.com/laolisafe/CVE-2020-1938

- https://github.com/leonooo13/CNVD-2020-10487-Tomcat-Ajp-lfi

- https://github.com/lions2012/Penetration_Testing_POC

- https://github.com/lizhianyuguangming/TomcatScanPro

- https://github.com/lnick2023/nicenice

- https://github.com/lovechinacoco/https-github.com-mai-lang-chai-Middleware-Vulnerability-detection

- https://github.com/ltfafei/my_POC

- https://github.com/m3n0sd0n4ld/uCVE

- https://github.com/merlinepedra/Pentest-Tools

- https://github.com/merlinepedra25/Pentest-Tools

- https://github.com/merlinepedra25/Pentest-Tools-1

- https://github.com/microservices-devsecops-organization/movie-catalog-service-dev

- https://github.com/mitalina/Perform-a-Basic-Vulnerability-Scan-using-Nessus

- https://github.com/n0-traces/cve_monitor

- https://github.com/naozibuhao/CNVD-2020-10487-Tomcat-ajp-POC-A

- https://github.com/neilzhang1/Chinese-Charts

- https://github.com/netveil/Awesome-List

- https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC

- https://github.com/ninahonyango/VAPT

- https://github.com/nitishbadole/Pentest_Tools

- https://github.com/nomi-sec/PoC-in-GitHub

- https://github.com/okostine-panw/pc_scripts

- https://github.com/onewinner/VulToolsKit

- https://github.com/parzival-4/Tomcat-ajp-filedownload

- https://github.com/password520/Penetration_PoC

- https://github.com/password520/RedTeamer

- https://github.com/pathakabhi24/Pentest-Tools

- https://github.com/pedr0alencar/vlab-metasploitable2

- https://github.com/pentration/gongkaishouji

- https://github.com/pinkie-ljz/GitHub-Chinese-Top-Charts

- https://github.com/pinkieli/GitHub-Chinese-Top-Charts

- https://github.com/pjgmonteiro/Pentest-tools

- https://github.com/plzheheplztrying/cve_monitor

- https://github.com/q99266/saury-vulnhub

- https://github.com/qazbnm456/awesome-cve-poc

- https://github.com/qingyuanfeiniao/Chinese-Top-Charts

- https://github.com/readloud/Awesome-Stars

- https://github.com/retr0-13/Goby

- https://github.com/retr0-13/Pentest-Tools

- https://github.com/rizemon/OSCP-PWK-Notes

- https://github.com/rob-cobbins/AttackSurfaceLab

- https://github.com/ronoski/j2ee-rscan

- https://github.com/s1mpl3c0d3/cvepoc

- https://github.com/s3nd3rjz/poc-CVE-2020-1938

- https://github.com/safe6Sec/PentestNote

- https://github.com/severnake/Pentest-Tools

- https://github.com/sgdream/CVE-2020-1938

- https://github.com/shanyuhe/YesPoc

- https://github.com/shaunmclernon/ghostcat-verification

- https://github.com/soosmile/POC

- https://github.com/sreerag27-ms/Metasploitable2-Nessus-vulnerability-assessment

- https://github.com/starlingvibes/TryHackMe

- https://github.com/streghstreek/CVE-2020-1938

- https://github.com/substing/tomghost_ctf

- https://github.com/sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read

- https://github.com/tanjiti/sec_profile

- https://github.com/tdtc7/qps

- https://github.com/technicalcorp2/CVE-2020-1938-Exploit

- https://github.com/testermas/tryhackme

- https://github.com/theyoge/AD-Pentesting-Tools

- https://github.com/threedr3am/learnjavabug

- https://github.com/tpt11fb/AttackTomcat

- https://github.com/ucsb-seclab/CVEX

- https://github.com/user-v10137/Learning_log

- https://github.com/uttambodara/Awesome-Hacking-Learning-Path

- https://github.com/uuuuuuuzi/BugRepairsuggestions

- https://github.com/veo/vscan

- https://github.com/versio-io/product-lifecycle-security-api

- https://github.com/vshaliii/Basic-Pentesting-2-Vulnhub-Walkthrough

- https://github.com/w3workerz/THM-Walkthroughs

- https://github.com/w4fz5uck5/CVE-2020-1938-Clean-Version

- https://github.com/weeka10/-hktalent-TOP

- https://github.com/whatboxapp/GhostCat-LFI-exp

- https://github.com/winterwolf32/CVE-S---Penetration_Testing_POC-

- https://github.com/woaiqiukui/CVE-2020-1938TomcatAjpScanner

- https://github.com/woodpecker-appstore/tomcat-vuldb

- https://github.com/woods-sega/woodswiki

- https://github.com/wukong-bin/PeiQi-LandGrey-ClassHound

- https://github.com/wuvel/TryHackMe

- https://github.com/xbl3/awesome-cve-poc_qazbnm456

- https://github.com/xindongzhuaizhuai/CVE-2020-1938

- https://github.com/xuetusummer/Penetration_Testing_POC

- https://github.com/ycdxsb/Exploits

- https://github.com/yedada-wei/-

- https://github.com/yedada-wei/gongkaishouji

- https://github.com/yq1ng/Java

- https://github.com/ze0r/GhostCat-LFI-exp

- https://github.com/zhaojunliing/awesome-stars

- https://github.com/zhzyker/exphub

- https://github.com/zoroqi/my-awesome