{"id":72053,"date":"2020-03-01T08:42:47","date_gmt":"2020-03-01T05:42:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij"},"modified":"2020-03-03T16:10:21","modified_gmt":"2020-03-03T13:10:21","slug":"uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","title":{"rendered":"Apache Tomcat'i haavatavus, mis v\u00f5imaldab JSP-koodi sisestada ja veebirakenduste faile saada","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hiina ettev\u00f5tte Chaitin Tech uurijad avastasid haavatavus<\/a><\/noindex> (CVE-2020-1938<\/a><\/noindex>) Apache Tomcat<\/a><\/noindex>, Java Servlet, JavaServer Pages, Java Expression Language ja Java WebSocket tehnoloogiate avatud rakenduse. Haavatavusele on antud koodnimi Ghostcat ja see on kriitilise tasemega oht (9.8 CVSS). Probleem v\u00f5imaldab vaike konfiguratsioonis saata p\u00e4ringu kaudu v\u00f5rgupordile 8009 lugeda mis tahes faili sisu veebi rakenduse kataloogist, sealhulgas konfiguratsioonifailide ja rakenduse l\u00e4htekoodide faile.<\/p>\n

Haavatavus annab ka v\u00f5imaluse importida teiste faile rakenduse koodi, mis v\u00f5imaldab korraldada koodi t\u00e4itmist servers, kui rakendus lubab faile serverisse laadida (n\u00e4iteks v\u00f5ib r\u00fcndaja laadida JSP-skripti pildi n\u00e4ol l\u00e4bi pildifaili laadimisvormi). R\u00fcnnak saab toimuma, kui on v\u00f5imalik saata p\u00e4ring v\u00f5rgupordile, kus t\u00f6\u00f6tab AJP t\u00f6\u00f6tleja. Esialgsete andmete kohaselt on v\u00f5rgus leiti<\/a><\/noindex> \u00fcle 1,2 miljoni hosti, mis aktsepteerivad p\u00e4ringute protokolli AJP. <\/p>\n

Haavatavus esineb AJP protokollis ning ei ole p\u00f5hjustatud<\/a><\/noindex> protsesside rakendamise vea t\u00f5ttu. Lisaks HTTP \u00fchenduste vastuv\u00f5tmisele (port 8080) lubab Apache Tomcat vaikimisi kuulata web-rakendusele AJP protokolli kaudu (Apache Jserv Protocol<\/a><\/noindex>, port 8009), mis on HTTP binaarne analoog, optimeeritud k\u00f5rgema j\u00f5udluse saavutamiseks ja mida kasutatakse tavaliselt Tomcat-serverite klastrite loomisel v\u00f5i Tomcati kiiremaks suhtlemiseks tagasip\u00f6\u00f6rdumise vaheproksi v\u00f5i koormuse tasakaalustajaga.<\/p>\n

AJP pakub vaikimisi funktsiooni juurdep\u00e4\u00e4suks serveri failidele, mida saab kasutada sealhulgas failide saamiseks, mis ei ole avalikustatud. Eeldatakse, et AJP ligip\u00e4\u00e4s on avatud ainult usaldusv\u00e4\u00e4rsetele serveritele, kuid tegelikult oli Tomcat vaikimisi konfigureeritud t\u00f6\u00f6tama k\u00f5igil v\u00f5rguliideseid, ning p\u00e4ringud v\u00f5eti vastu ilma autentimiseta. Juhtmed on v\u00f5imalikud mis tahes web-rakenduse failidele, sealhulgas sisu jaoks WEB-INF, META-INF ja mistahes muude kaustade jaoks, mida saadetakse l\u00e4bi ServletContext.getResourceAsStream() kutsumise. AJP v\u00f5imaldab samuti kasutada mis tahes faili web-rakenduse juurdep\u00e4\u00e4setavates kaustades JSP skriptina.<\/p>\n

Probleem ilmneb alates Tomcat 6.x versiooni v\u00e4ljastamisest, mis toimus 13 aastat tagasi. Probleem puudutab samuti Tomcatit ja sellel p\u00f5hinevaid tooteid, puudutab<\/a><\/noindex> nagu Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP) ning ka iseseisvad veebirakendused, mis kasutavad Spring Boot<\/a><\/noindex>. Sarnane haavatavus (CVE-2020-1745) on olemas<\/a><\/noindex> veebiserveris Undertow<\/a><\/noindex>, mida rakendatakse Wildfly rakenduste serveris. JBossi ja Wildfly AJP protokoll on vaikimisi lubatud ainult standalone-full-ha.xml, standalone-ha.xml ja ha\/full-ha profiilides domain.xml failis. Spring Bootis on AJP toetus vaikimisi v\u00e4lja l\u00fclitatud. Praegu on erinevad r\u00fchmad valmistanud rohkem kui tosin t\u00f6\u00f6korda viidud eksploiti (
\n 1<\/a><\/noindex>,
\n 2<\/a><\/noindex>,
\n 3<\/a><\/noindex>,
\n 4<\/a><\/noindex>,
\n 5<\/a><\/noindex>,
\n 6<\/a><\/noindex>,
\n 7<\/a><\/noindex>,
\n 8<\/a><\/noindex>,
\n 9<\/a><\/noindex>,
\n 10<\/a><\/noindex>,
\n 11<\/a><\/noindex>). <\/p>\n

Haavatavus on k\u00f5rvaldatud Tomcat'i 9.0.31<\/a><\/noindex>, 8.5.51<\/a><\/noindex> ja 7.0.100<\/a><\/noindex> (6.x versiooni hooldus katkestatud<\/a><\/noindex>). Uuenduste v\u00e4ljalaskmise j\u00e4lgimiseks distributsioonides saab k\u00fclastada j\u00e4rgmisi lehti: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. Turvateenuse v\u00e4ltimiseks v\u00f5ite v\u00e4lja l\u00fclitada Tomcat AJP Connector'i (siduda kuulav sokkel localhostiga v\u00f5i kommenteerida rida Connector port = '8009'), kui seda ei ole vaja, v\u00f5i konfigureerida<\/a><\/noindex> autentimisjuurdep\u00e4\u00e4s atribuutide 'secret' ja 'address' abil, kui teenust kasutatakse teiste serverite ja mod_jk ning mod_proxy_ajp (mod_cluster autentimist ei toeta) vahelise suhtluse jaoks. <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1938) \u0432 Apache Tomcat, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 Java Servlet, JavaServer Pages, Java Expression Language \u0438 Java WebSocket. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ghostcat \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 CVSS). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u043e\u0440\u0442\u0443 8009 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72053","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Apache Tomcatis, mis v\u00f5imaldab sisestada JSP-koodi ja saada web-rakenduste faile | ProHoster","description":"Hiina ettev\u00f5tte Chaitin Tech teadlased on tuvastanud haavatavuse (","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Tomcat, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c JSP-\u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T05:42:47+00:00","article:modified_time":"2020-03-03T13:10:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72053","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-08 06:25:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/72053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=72053"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/72053\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=72053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=72053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=72053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}