{"id":72053,"date":"2020-03-01T08:42:47","date_gmt":"2020-03-01T05:42:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij"},"modified":"2020-03-03T16:10:21","modified_gmt":"2020-03-03T13:10:21","slug":"uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","title":{"rendered":"S\u00e5rbarhed i Apache Tomcat, der tillader inds\u00e6ttelse af JSP-kode og adgang til webapplikationsfiler","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskere fra det kinesiske firma Chaitin Tech har identificeret ASLR i programmer med setuid-flaget og bestemme adressefordelingen i de indl\u00e6ste biblioteker gennem manipulation af milj\u00f8variablen LD_PREFER_MAP_32BIT_EXEC.<\/a><\/noindex> (CVE-2020-1938<\/a><\/noindex>) i Apache Tomcat<\/a><\/noindex>, en open source-implementering af Java Servlet-teknologier, JavaServer Pages, Java Expression Language og Java WebSocket. S\u00e5rbarheden har f\u00e5et kodeordet Ghostcat og en kritisk faregrad (9.8 CVSS). Problemet muligg\u00f8r, at indholdet af alle filer fra web-applikationens mappe kan l\u00e6ses via netv\u00e6rksport 8009 ved standardkonfigurationen, herunder konfigurationsfiler og kildekoden til applikationen.<\/p>\n

S\u00e5rbarheden giver ogs\u00e5 mulighed for at importere andre filer til applikationens kode, hvilket muligg\u00f8r udf\u00f8relse af kode p\u00e5 serveren, hvis applikationen tillader upload af filer til serveren (for eksempel kan en angriber uploade et JSP-script under d\u00e6kke af et billede via en uploadformular). Angrebet kan udf\u00f8res, hvis der er mulighed for at sende en anmodning til netv\u00e6rksporten med AJP-behandleren. If\u00f8lge forel\u00f8bige data er der fundet<\/a><\/noindex> over 1,2 millioner v\u00e6rter, der modtager anmodninger via AJP-protokollen. <\/p>\n

S\u00e5rbarheden findes i AJP-protokollen, og ikke for\u00e5rsaget<\/a><\/noindex> af en fejl i implementeringen. Udover at acceptere forbindelser via HTTP (port 8080) tillader Apache Tomcat som standard ogs\u00e5 adgang til web-applikationen via AJP-protokollen (Apache Jserv Protocol<\/a><\/noindex>, port 8009), som er en optimeret bin\u00e6r tilsvarende til HTTP designet til at opn\u00e5 h\u00f8jere ydeevne, der typisk anvendes ved oprettelse af et Tomcat-serverkluster eller for at fremskynde interaktionen med Tomcat p\u00e5 en omvendt proxy eller belastningsbalancer.<\/p>\n

AJP tilbyder en standardfunktion til adgang til filer p\u00e5 serveren, som ogs\u00e5 kan bruges til at hente filer, der ikke m\u00e5 offentligg\u00f8res. Det antages, at adgangen til AJP kun er \u00e5ben for betroede servere, men i praksis blev AJP-handleren startet p\u00e5 alle netv\u00e6rksinterfaces, og anmodninger blev accepteret uden autentifikation, if\u00f8lge standardkonfigurationen for Tomcat. Adgang til enhver fil i web-applikationen er mulig, herunder indholdet af WEB-INF, META-INF og enhver anden mappe, der kan returneres via ServletContext.getResourceAsStream(). AJP tillader ogs\u00e5 at bruge enhver fil i de tilg\u00e6ngelige mapper til web-applikationen som et JSP-script.<\/p>\n

Problemet blev f\u00f8rst opdaget i den version af Tomcat 6.x, der blev frigivet for 13 \u00e5r siden. Udover selve Tomcat er problemet affects<\/a><\/noindex> og og de produkter, der bruger det, s\u00e5som Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP), samt selvst\u00e6ndige webapplikationer, der bruger Spring Boot<\/a><\/noindex>. En tilsvarende s\u00e5rbarhed (CVE-2020-1745) til stede<\/a><\/noindex> i webserveren Undertow<\/a><\/noindex>, der anvendes i applikationsserveren Wildfly. I JBoss og Wildfly er AJP-protokollen som standard kun aktiveret i standalone-full-ha.xml, standalone-ha.xml og ha\/full-ha profiler i domain.xml. I Spring Boot er AJP-support som standard deaktiveret. I \u00f8jeblikket har forskellige grupper forberedt over et dusin fungerende eksempler p\u00e5 exploits (
\n 1<\/a><\/noindex>,
\n 2<\/a><\/noindex>,
\n 3<\/a><\/noindex>,
\n 4<\/a><\/noindex>,
\n 5<\/a><\/noindex>,
\n 6<\/a><\/noindex>,
\n 7<\/a><\/noindex>,
\n 8<\/a><\/noindex>,
\n 9<\/a><\/noindex>,
\n 10<\/a><\/noindex>,
\n 11<\/a><\/noindex>). <\/p>\n

S\u00e5rbarheden er blevet rettet i Tomcat-versioner 9.0.31<\/a><\/noindex>, 8.5.51<\/a><\/noindex> og 7.0.100<\/a><\/noindex> (vedligeholdelse af 6.x-grenen oph\u00f8rt<\/a><\/noindex>). Opdateringer i distributionerne kan f\u00f8lges p\u00e5 disse sider: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>Som en midlertidig sikkerhedsforanstaltning kan du deaktivere Tomcat AJP Connector-tjenesten (binde lytte-socket til localhost eller kommentere linjen med Connector port = \u00ab8009\u00bb), hvis den ikke er n\u00f8dvendig, eller konfigurere<\/a><\/noindex> autentificeret adgang ved hj\u00e6lp af attributterne \u00absecret\u00bb og \u00abaddress\u00bb, hvis tjenesten bruges til interaktion med andre servere og proxyer baseret p\u00e5 mod_jk og mod_proxy_ajp (mod_cluster underst\u00f8tter ikke autentifikation). <\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1938) \u0432 Apache Tomcat, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 Java Servlet, JavaServer Pages, Java Expression Language \u0438 Java WebSocket. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ghostcat \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 CVSS). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u043e\u0440\u0442\u0443 8009 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72053","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i Apache Tomcat, der tillader indspr\u00f8jtning af JSP-kode og adgang til webapplikationsfiler | ProHoster","description":"Forskere fra det kinesiske selskab Chaitin Tech afsl\u00f8rede s\u00e5rbarheden (","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Tomcat, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c JSP-\u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T05:42:47+00:00","article:modified_time":"2020-03-03T13:10:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72053","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-08 06:25:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/72053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=72053"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/72053\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=72053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=72053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=72053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}