Shulou(Shulou.com)05/31 Report--

Editor to share with you the Tomcat Ajp file reading vulnerabilities recurrence of the example analysis, I believe that most people do not understand, so share this article for your reference, I hope you will learn a lot after reading this article, let's go to understand it!

Brief introduction of vulnerabilities

Due to a file inclusion flaw in the AJP service (port 8009) enabled by Tomcat by default, an attacker can construct a malicious request packet for file inclusion operation to read the Web directory file on the affected Tomcat server.

Https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1938

Scope of influence

Apache Tomcat 6

Apache Tomcat 7 < 7.0.100

Apache Tomcat 8 < 8.5.51

Apache Tomcat 9 < 9.0.31

1. Install the docker environment first

1.1 apt-get update

1.2 apt-get install-y apt-transport-https ca-certificates

1.3 apt-get install dirmngr

1.4 curl-fsSL https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/debian/gpg | sudo apt-key add-

1.5 echo 'deb https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/debian/ buster stable' | sudo tee / etc/apt/sources.list.d/docker.list

1.6 apt-get update

1.7 apt install docker-ce

1.8 service docker status~

1.9 service docker status

2.0 service docker start

2.1 service docker version

2.2 docker version

2.3 docker run hello-world

Environment building:

Download image docker pull negoowen/ghostcat:1.0

Start mirroring

Docker run-d-p 8080 8080-p 8009 8009-- name ghostcat negoowen/ghostcat:1.0

Loophole recurrence

Read a file

A test.txt file has been written into the image and tested with this file

Python CVE-2020-1938.py-p 8009-f test.txt 192.168.195.133

Repair suggestion

1. Official upgrade

Apache Tomcat 7.0.100

Apache Tomcat 8.5.51

Apache Tomcat 9.0.31

two。 Turn off AJP and open the port by default (8009 here) or listen locally only

The above is all the contents of this article entitled "sample Analysis of the recurrence of Ajp File Reading vulnerabilities in Tomcat". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.