If your web server is running on Apache Tomcat, you should immediately install the latest available version of the server application to prevent hackers from taking unauthorised control over it.
Yes, that’s possible because all versions (9.x/8.x/7.x/6.x) of the Apache Tomcat released in the past 13 years have been found vulnerable to a new high-severity (CVSS 9.8) ‘file read and inclusion bug‘—which can be exploited in the default configuration.
But it’s more concerning because several proof-of-concept exploits (1, 2, 3, 4 and more) for this vulnerability have also been surfaced on the Internet, making it easy for anyone to hack into publicly accessible vulnerable web servers.
Dubbed ‘Ghostcat‘ and tracked as CVE-2020-1938, the flaw could let unauthenticated, remote attackers read the content of any file on a vulnerable web server and obtain sensitive configuration files or source code, or execute arbitrary code if the server allows file upload, as shown in a demo below.
What is Ghostcat Flaw And How Does it Work?
According to Chinese cybersecurity company Chaitin Tech, the vulnerability resides in the AJP protocol of Apache Tomcat software that arises due to improper handling of an attribute.
“If the site allows users upload file, an attacker can first upload a file containing malicious JSP script code to the server (the uploaded file itself can be of any filetype, such as pictures, plain text files, etc.), and then include the uploaded file by exploiting the Ghostcat, which finally can result in remote code execution,” the researchers said.
Apache JServ Protocol (AJP) protocol is basically an optimized version of the HTTP protocol to allow Tomcat to communicate with an Apache web-server.
images from Hacker News
Recent Comments