{"id":72053,"date":"2020-03-01T08:42:47","date_gmt":"2020-03-01T05:42:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij"},"modified":"2020-03-03T16:10:21","modified_gmt":"2020-03-03T13:10:21","slug":"uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","title":{"rendered":"Zranitelnost v Apache Tomcat, kter\u00e1 umo\u017e\u0148uje vlo\u017een\u00ed JSP k\u00f3du a z\u00edsk\u00e1n\u00ed soubor\u016f webov\u00fdch aplikac\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci z \u010d\u00ednsk\u00e9 spole\u010dnosti Chaitin Tech odhalili zranitelnost<\/a><\/noindex> (CVE-2020-1938<\/a><\/noindex>) v Apache Tomcat<\/a><\/noindex>, otev\u0159enou implementaci technologi\u00ed Java Servlet, JavaServer Pages, Java Expression Language a Java WebSocket. Zranitelnost byla ozna\u010dena k\u00f3dov\u00fdm n\u00e1zvem Ghostcat a je klasifikov\u00e1na jako kritick\u00e1 (9.8 CVSS). Probl\u00e9m umo\u017e\u0148uje ve v\u00fdchoz\u00ed konfiguraci p\u0159e\u010d\u00edst obsah jak\u00fdchkoli soubor\u016f z adres\u00e1\u0159e webov\u00e9 aplikace prost\u0159ednictv\u00edm odesl\u00e1n\u00ed po\u017eadavku na s\u00ed\u0165ov\u00fd port 8009, v\u010detn\u011b soubor\u016f s nastaven\u00edmi a zdrojov\u00fdch k\u00f3d\u016f aplikace.<\/p>\n

Zranitelnost tak\u00e9 umo\u017e\u0148uje import dal\u0161\u00edch soubor\u016f do k\u00f3du aplikace, co\u017e umo\u017e\u0148uje prov\u00e1d\u011bn\u00ed k\u00f3du na serveru, pokud aplikace povoluje nahr\u00e1v\u00e1n\u00ed soubor\u016f na server (nap\u0159\u00edklad \u00fato\u010dn\u00edk m\u016f\u017ee nahr\u00e1t JSP skript pod z\u00e1minkou obr\u00e1zku prost\u0159ednictv\u00edm formul\u00e1\u0159e pro nahr\u00e1v\u00e1n\u00ed obr\u00e1zk\u016f). \u00datok m\u016f\u017ee b\u00fdt proveden, pokud je mo\u017en\u00e9 odeslat po\u017eadavek na s\u00ed\u0165ov\u00fd port s AJP zpracovatelem. Podle p\u0159edb\u011b\u017en\u00fdch \u00fadaj\u016f bylo v s\u00edti nalezeno<\/a><\/noindex> v\u00edce ne\u017e 1,2 milionu hostitel\u016f, kter\u00e9 p\u0159ij\u00edmaj\u00ed po\u017eadavky prost\u0159ednictv\u00edm protokolu AJP. <\/p>\n

Zranitelnost je p\u0159\u00edtomn\u00e1 v protokolu AJP, a nebyla zp\u016fsobena<\/a><\/noindex> chybou v implementaci. Krom\u011b p\u0159ij\u00edm\u00e1n\u00ed p\u0159ipojen\u00ed prost\u0159ednictv\u00edm HTTP (port 8080) umo\u017e\u0148uje Apache Tomcat ve v\u00fdchoz\u00ed konfiguraci p\u0159\u00edstup k webov\u00e9 aplikaci p\u0159es protokol AJP (Apache Jserv Protocol<\/a><\/noindex>, port 8009), kter\u00fd p\u0159edstavuje optimalizovan\u00fd bin\u00e1rn\u00ed ekvivalent HTTP pro dosa\u017een\u00ed vy\u0161\u0161\u00ed v\u00fdkonnosti, obvykle pou\u017e\u00edvan\u00fd p\u0159i vytv\u00e1\u0159en\u00ed clusteru Tomcat server\u016f nebo pro zrychlen\u00ed komunikace s Tomcat na reverzn\u00edm proxy serveru nebo vyrovn\u00e1va\u010di zat\u00ed\u017een\u00ed.<\/p>\n

AJP poskytuje vestav\u011bnou funkci pro p\u0159\u00edstup k soubor\u016fm na serveru, kterou lze pou\u017e\u00edt i k z\u00edsk\u00e1n\u00ed soubor\u016f, kter\u00e9 nemaj\u00ed b\u00fdt zve\u0159ejn\u011bny. P\u0159edpokl\u00e1d\u00e1 se, \u017ee p\u0159\u00edstup k AJP je otev\u0159en pouze pro d\u016fv\u011bryhodn\u00e9 servery, ale ve skute\u010dnosti byl ve v\u00fdchoz\u00ed konfiguraci Tomcat nastaven zpracovatel pro v\u0161echny s\u00ed\u0165ov\u00e9 rozhran\u00ed a po\u017eadavky byly p\u0159ij\u00edm\u00e1ny bez autentizace. P\u0159\u00edstup je mo\u017en\u00fd k jak\u00fdmkoli soubor\u016fm webov\u00e9 aplikace, v\u010detn\u011b obsahu WEB-INF, META-INF a jak\u00fdchkoli dal\u0161\u00edch adres\u00e1\u0159\u016f, kter\u00e9 jsou vraceny prost\u0159ednictv\u00edm vol\u00e1n\u00ed ServletContext.getResourceAsStream(). AJP tak\u00e9 umo\u017e\u0148uje pou\u017e\u00edvat jak\u00fdkoli soubor v adres\u00e1\u0159\u00edch dostupn\u00fdch pro webovou aplikaci jako JSP skript.<\/p>\n

Probl\u00e9m se projevuje od vyd\u00e1n\u00ed verze Tomcat 6.x p\u0159ed 13 lety. Krom\u011b samotn\u00e9ho Tomcatu se probl\u00e9m ovliv\u0148uje<\/a><\/noindex> a produkty, kter\u00e9 jej pou\u017e\u00edvaj\u00ed, jako je Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP) a tak\u00e9 samostatn\u00e9 webov\u00e9 aplikace, kter\u00e9 vyu\u017e\u00edvaj\u00ed Spring Boot<\/a><\/noindex>. Podobn\u00e1 zranitelnost (CVE-2020-1745) je p\u0159\u00edtomno<\/a><\/noindex> ve webov\u00e9m serveru Undertow<\/a><\/noindex>, kter\u00fd se pou\u017e\u00edv\u00e1 v aplika\u010dn\u00edm serveru Wildfly. V JBoss a Wildfly je protokol AJP ve v\u00fdchoz\u00edm nastaven\u00ed povolen pouze v profilech standalone-full-ha.xml, standalone-ha.xml a ha\/full-ha v domain.xml. V Spring Boot je podpora AJP ve v\u00fdchoz\u00edm nastaven\u00ed zak\u00e1z\u00e1na. V sou\u010dasnosti bylo r\u016fzn\u00fdmi skupinami p\u0159ipraveno v\u00edce ne\u017e tucet pracovn\u00edch p\u0159\u00edklad\u016f exploit\u016f (
\n 1<\/a><\/noindex>,
\n 2<\/a><\/noindex>,
\n 3<\/a><\/noindex>,
\n 4<\/a><\/noindex>,
\n 5<\/a><\/noindex>,
\n 6<\/a><\/noindex>,
\n 7<\/a><\/noindex>,
\n 8<\/a><\/noindex>,
\n 9<\/a><\/noindex>,
\n 10<\/a><\/noindex>,
\n 11<\/a><\/noindex>). <\/p>\n

Zranitelnost byla odstran\u011bna v verz\u00edch Tomcat 9.0.31<\/a><\/noindex>, 8.5.51<\/a><\/noindex> a 7.0.100<\/a><\/noindex> (podpora v\u011btve 6.x zastaveno<\/a><\/noindex>). Sledovat vyd\u00e1n\u00ed aktualizac\u00ed v distribuc\u00edch lze na t\u011bchto str\u00e1nk\u00e1ch: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. Jako obran\u00e9 opat\u0159en\u00ed m\u016f\u017eete zak\u00e1zat slu\u017ebu Tomcat AJP Connector (p\u0159ipojit poslouchaj\u00edc\u00ed soket na localhost nebo zakomentovat \u0159\u00e1dek s portem Connector = «8009»), pokud nen\u00ed pot\u0159eba, nebo nastavit<\/a><\/noindex> autentizovan\u00fd p\u0159\u00edstup pomoc\u00ed atribut\u016f «secret» a «address», pokud se slu\u017eba pou\u017e\u00edv\u00e1 pro interakci s jin\u00fdmi servery a proxy na b\u00e1zi mod_jk a mod_proxy_ajp (mod_cluster autentizaci nepodporuje). <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1938) \u0432 Apache Tomcat, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 Java Servlet, JavaServer Pages, Java Expression Language \u0438 Java WebSocket. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ghostcat \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 CVSS). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u043e\u0440\u0442\u0443 8009 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72053","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v Apache Tomcat, kter\u00e1 umo\u017e\u0148uje vkl\u00e1d\u00e1n\u00ed JSP k\u00f3du a z\u00edsk\u00e1n\u00ed soubor\u016f webov\u00fdch aplikac\u00ed | ProHoster","description":"V\u00fdzkumn\u00edci z \u010d\u00ednsk\u00e9 spole\u010dnosti Chaitin Tech odhalili zranitelnost (","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Tomcat, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c JSP-\u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T05:42:47+00:00","article:modified_time":"2020-03-03T13:10:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72053","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-08 06:25:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/72053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=72053"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/72053\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=72053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=72053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=72053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}