{"id":72053,"date":"2020-03-01T08:42:47","date_gmt":"2020-03-01T05:42:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij"},"modified":"2020-03-03T16:10:21","modified_gmt":"2020-03-03T13:10:21","slug":"uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","title":{"rendered":"Vulnerability in Apache Tomcat allowing to inject JSP code and access web application files","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Badacze z chi\u0144skiej firmy Chaitin Tech odkryli luka<\/a><\/noindex> (CVE-2020-1938<\/a><\/noindex>) w Apache Tomcat<\/a><\/noindex>, otwartej implementacji technologii Java Servlet, JavaServer Pages, Java Expression Language i Java WebSocket. Luka przyj\u0119\u0142a nazw\u0119 kodow\u0105 Ghostcat i zosta\u0142a oceniona na krytyczny poziom zagro\u017cenia (9.8 CVSS). Problem pozwala w konfiguracji domy\u015blnej na odczytanie zawarto\u015bci wszelkich plik\u00f3w z katalogu aplikacji webowej poprzez wys\u0142anie \u017c\u0105dania na porcie sieciowym 8009, w tym plik\u00f3w konfiguracyjnych i \u017ar\u00f3d\u0142owych aplikacji.<\/p>\n

Luka ta r\u00f3wnie\u017c umo\u017cliwia importowanie innych plik\u00f3w do kodu aplikacji, co pozwala na wykonanie kodu na serwerze, je\u015bli aplikacja zezwala na wgrywanie plik\u00f3w na serwer (na przyk\u0142ad atakuj\u0105cy mo\u017ce wgrza\u0107 skrypt JSP udaj\u0105cy obrazek za po\u015brednictwem formularza przesy\u0142ania obrazu). Atak mo\u017ce zosta\u0107 przeprowadzony, je\u015bli istnieje mo\u017cliwo\u015b\u0107 wysy\u0142ania \u017c\u0105da\u0144 na port sieciowy z obs\u0142ug\u0105 AJP. Wed\u0142ug wst\u0119pnych danych, w sieci znaleziono<\/a><\/noindex> ponad 1,2 miliona host\u00f3w akceptuj\u0105cych \u017c\u0105dania przez protok\u00f3\u0142 AJP. <\/p>\n

Luka wyst\u0119puje w protokole AJP, a nie jest spowodowana<\/a><\/noindex> b\u0142\u0119dem w implementacji. Opr\u00f3cz przyjmowania po\u0142\u0105cze\u0144 przez HTTP (port 8080), Apache Tomcat w domy\u015blnej konfiguracji zezwala na dost\u0119p do aplikacji webowej poprzez protok\u00f3\u0142 AJP (Apache Jserv Protocol<\/a><\/noindex>, port 8009), kt\u00f3ry jest zoptymalizowan\u0105 wersj\u0105 binarn\u0105 HTTP, stosowan\u0105 zazwyczaj w klastrach serwer\u00f3w Tomcat lub do przyspieszania interakcji z Tomcatem na odwrotnym proxy lub w r\u00f3wnowa\u017cniku obci\u0105\u017cenia.<\/p>\n

AJP zapewnia wbudowan\u0105 funkcj\u0119 dost\u0119pu do plik\u00f3w na serwerze, kt\u00f3r\u0105 mo\u017cna wykorzysta\u0107, w tym do uzyskiwania plik\u00f3w, kt\u00f3re nie powinny by\u0107 ujawnione. Zak\u0142ada si\u0119, \u017ce dost\u0119p do AJP jest otwarty tylko dla zaufanych serwer\u00f3w, jednak w rzeczywisto\u015bci w domy\u015blnej konfiguracji Tomcat uruchamia\u0142 obs\u0142ug\u0119 na wszystkich interfejsach sieciowych, a \u017c\u0105dania by\u0142y przyjmowane bez uwierzytelnienia. Dost\u0119p mo\u017cliwy jest do wszelkich plik\u00f3w aplikacji webowej, w tym do zawarto\u015bci WEB-INF, META-INF oraz wszelkich innych katalog\u00f3w, udost\u0119pnianych za pomoc\u0105 wywo\u0142ania ServletContext.getResourceAsStream(). AJP umo\u017cliwia r\u00f3wnie\u017c wykorzystywanie dowolnego pliku w dost\u0119pnych dla aplikacji webowej katalogach jako skryptu JSP.<\/p>\n

Problem wyst\u0119puje od wydania 13 lat temu wersji Tomcat 6.x. Opr\u00f3cz samego Tomcata, problem rozwi\u0105za\u0144 opartych na otwartym stosie UPnP<\/a><\/noindex> i produkty, kt\u00f3re go wykorzystuj\u0105, takie jak Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP), a tak\u017ce samodzielne aplikacje internetowe wykorzystuj\u0105ce Spring Boot<\/a><\/noindex>. Podobna podatno\u015b\u0107 (CVE-2020-1745) jest obecny<\/a><\/noindex> w serwerze WWW Undertow<\/a><\/noindex>, stosowanym w serwerze aplikacji Wildfly. W JBoss i Wildfly protok\u00f3\u0142 AJP jest domy\u015blnie w\u0142\u0105czony tylko w plikach standalone-full-ha.xml, standalone-ha.xml i ha\/full-ha w domain.xml. W Spring Boot wsparcie dla AJP jest domy\u015blnie wy\u0142\u0105czone. Obecnie r\u00f3\u017cne grupy przygotowa\u0142y ponad dziesi\u0119\u0107 dzia\u0142aj\u0105cych przyk\u0142ad\u00f3w exploit\u00f3w (
\n 1<\/a><\/noindex>,
\n 2<\/a><\/noindex>,
\n 3<\/a><\/noindex>,
\n 4<\/a><\/noindex>,
\n 5<\/a><\/noindex>,
\n 6<\/a><\/noindex>,
\n 7<\/a><\/noindex>,
\n 8<\/a><\/noindex>,
\n 9<\/a><\/noindex>,
\n 10<\/a><\/noindex>,
\n 11<\/a><\/noindex>). <\/p>\n

Podatno\u015b\u0107 zosta\u0142a naprawiona w wydaniach Tomcat 9.0.31<\/a><\/noindex>, 8.5.51<\/a><\/noindex> i 7.0.100<\/a><\/noindex> (wsparcie dla ga\u0142\u0119zi 6.x zako\u0144czony<\/a><\/noindex>). Aby \u015bledzi\u0107 wprowadzenie aktualizacji w dystrybucjach, mo\u017cna odwiedzi\u0107 te strony: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0439 \u043c\u0435\u0440\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0438\u0441 Tomcat AJP Connector (\u043f\u0440\u0438\u0432\u044f\u0437\u0430\u0442\u044c \u0441\u043b\u0443\u0448\u0430\u044e\u0449\u0438\u0439 \u0441\u043e\u043a\u0435\u0442 \u0441 localhost \u0438\u043b\u0438 \u0437\u0430\u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0442\u0440\u043e\u043a\u0443 \u0441 Connector port = «8009»), \u0435\u0441\u043b\u0438 \u0432 \u043d\u0451\u043c \u043d\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0438\u043b\u0438 by\u0107 skonfigurowana<\/a><\/noindex> \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u043e\u0432 «secret» \u0438 «address», \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0438\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u0438 \u043f\u0440\u043e\u043a\u0441\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 mod_jk \u0438 mod_proxy_ajp (mod_cluster \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442). <\/p>\n

<\/a><\/noindex><\/p>\n

\u0179r\u00f3d\u0142o: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1938) \u0432 Apache Tomcat, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 Java Servlet, JavaServer Pages, Java Expression Language \u0438 Java WebSocket. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ghostcat \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 CVSS). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u043e\u0440\u0442\u0443 8009 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72053","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luka w Apache Tomcat, kt\u00f3ra pozwala na wstrzykiwanie kodu JSP i uzyskiwanie plik\u00f3w aplikacji internetowych | ProHoster","description":"Badacze z chi\u0144skiej firmy Chaitin Tech zidentyfikowali luk\u0119 (","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Tomcat, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c JSP-\u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T05:42:47+00:00","article:modified_time":"2020-03-03T13:10:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72053","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-08 06:25:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/72053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=72053"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/72053\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=72053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=72053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=72053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}