adịghị ike na Apache Tomcat nke na-enye ohere iji dochie koodu JSP na ịnweta faịlụ ngwa weebụ

Ndị nyocha sitere na ụlọ ọrụ China Chaitin Tech achọpụtala adịghị ike (CVE-2020-1938) na Apache Tomcat, mmejuputa mmeghe nke Java Servlet, ibe JavaServer, asụsụ nkwupụta Java na teknụzụ WebSocket Java. Enyerela adịghị ike ahụ aha koodu Ghostcat yana ọkwa dị oke egwu (9.8 CVSS). Nsogbu a na-enye ohere, na nhazi ndabara, site na izipu arịrịọ na ọdụ ụgbọ mmiri 8009, ịgụ ọdịnaya nke faịlụ ọ bụla sitere na ndekọ ngwa weebụ, gụnyere faịlụ nwere ntọala na koodu isi ngwa.

Ọdịmma ahụ na-emekwa ka o nwee ike ibubata faịlụ ndị ọzọ n'ime koodu ngwa, nke na-enye ohere maka igbu koodu na ihe nkesa ma ọ bụrụ na ngwa ahụ na-enye ohere ka ebugo faịlụ na ihe nkesa (dịka ọmụmaatụ, onye na-awakpo nwere ike bulite edemede JSP na-agbanwe dị ka ihe oyiyi site na ya. ụdị nbudata ihe oyiyi). Enwere ike ịme mwakpo ahụ mgbe enwere ike izipu arịrịọ na ọdụ ụgbọ mmiri na onye na-ahụ maka AJP. Dị ka data mbido, online hụrụ Ihe karịrị nde ndị ọbịa 1.2 na-anabata arịrịọ site na protocol AJP.

Ọdịmma ahụ dị na protocol AJP, yana akpọghị ya njehie na mmejuputa iwu. Na mgbakwunye na ịnakwere njikọ site na HTTP (ọdụ ụgbọ mmiri 8080), Apache Tomcat na ndabara na-enye ohere ịnweta ngwa weebụ site na protocol AJP (Apache Jserv Protocol, ọdụ ụgbọ mmiri 8009), nke bụ ọnụọgụ abụọ nke HTTP kachasị maka ịrụ ọrụ dị elu, nke a na-ejikarị eme ihe mgbe ị na-emepụta ụyọkọ nke sava Tomcat ma ọ bụ mee ka mmekọrịta gị na Tomcat dịkwuo elu na proxy ma ọ bụ ihe nkwụnye ibu.

AJP na-enye ọrụ ọkọlọtọ maka ịnweta faịlụ na ihe nkesa, nke enwere ike iji, gụnyere ịnweta faịlụ ndị na-agaghị ekpughere. Ekwesịrị ịnweta AJP naanị maka sava ndị tụkwasịrị obi, mana n'ezie nhazi ndabara Tomcat mere onye na-ahụ maka ya na ntanetị netwọkụ niile wee nabata arịrịọ na-enweghị nkwenye. Enwere ike ịnweta faịlụ ngwa weebụ ọ bụla, gụnyere ọdịnaya nke WEB-INF, META-INF na akwụkwọ ndekọ aha ọ bụla enyere site na oku na ServletContext.getResourceAsStream(). AJP na-enyekwa gị ohere iji faịlụ ọ bụla na akwụkwọ ndekọ aha ịnweta ngwa weebụ dị ka script JSP.

Nsogbu a na-apụta kemgbe alaka Tomcat 13.x wepụtara afọ iri na atọ gara aga. Na mgbakwunye na nsogbu Tomcat n'onwe ya na-emetụta na ngwaahịa ndị na-eji ya, dị ka Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP), yana ngwa weebụ nwere onwe ya na-eji. Mmiri buut. Ihe ọghọm yiri ya (CVE-2020-1745) ugbu a na sava weebụ Gbochie, eji na ihe nkesa ngwa Wildfly. Na JBoss na Wildfly, AJP na-enyere ya aka na ndabara naanị na standalone-full-ha.xml, standalone-ha.xml na ha/ful-ha profaịlụ na domain.xml. Na Spring Boot, nkwado AJP nwere nkwarụ site na ndabara. Ugbu a, otu dị iche iche akwadola ihe atụ ọrụ karịrị iri na abuo nke irigbu (
1,
2,
3,
4,
5,
6,
7,
8,
9,
10,
11).

Edobere adịghị ike na mwepụta Tomcat 9.0.31, 8.5.51 и 7.0.100 (ịkwado ngalaba 6.x kwụsịrị). Ị nwere ike soro nwelite mmelite na ngwa nkesa na ibe ndị a: Debian, Ubuntu, RHEL, Fedora, EBU, FreeBSD. Dị ka ihe na-arụ ọrụ, ị nwere ike gbanyụọ ọrụ Njikọ Tomcat AJP (jikọọ oghere na-ege ntị na localhost ma ọ bụ kwuo ahịrị na ọdụ ụgbọ mmiri = "8009") ma ọ bụrụ na ọ dịghị mkpa, ma ọ bụ melite ohere enwetara site na iji njirimara “nzuzo” na “adreesị” ma ọ bụrụ na ejiri ọrụ a na-emekọrịta ihe na sava ndị ọzọ na proxies dabere na mod_jk na mod_proxy_ajp (mod_cluster anaghị akwado nyocha).

isi: opennet.ru