{"id":72053,"date":"2020-03-01T08:42:47","date_gmt":"2020-03-01T05:42:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij"},"modified":"2020-03-03T16:10:21","modified_gmt":"2020-03-03T13:10:21","slug":"uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","title":{"rendered":"Vulnerabilidade no Apache Tomcat que permite a inje\u00e7\u00e3o de c\u00f3digo JSP e acesso a arquivos de web aplicativos","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pesquisadores da empresa chinesa Chaitin Tech identificaram uma vulnerabilidade<\/a><\/noindex> (CVE-2020-1938<\/a><\/noindex>) em Apache Tomcat<\/a><\/noindex>, uma implementa\u00e7\u00e3o aberta das tecnologias Java Servlet, JavaServer Pages, Java Expression Language e Java WebSocket. A vulnerabilidade foi nomeada Ghostcat e classificada com um n\u00edvel cr\u00edtico de severidade (9.8 CVSS). O problema permite que, na configura\u00e7\u00e3o padr\u00e3o, ao enviar uma solicita\u00e7\u00e3o pela porta de rede 8009, seja poss\u00edvel ler o conte\u00fado de quaisquer arquivos do diret\u00f3rio do aplicativo web, incluindo arquivos de configura\u00e7\u00e3o e c\u00f3digos fonte do aplicativo.<\/p>\n

A vulnerabilidade tamb\u00e9m permite importar outros arquivos para o c\u00f3digo do aplicativo, o que pode resultar na execu\u00e7\u00e3o de c\u00f3digo no servidor, se o aplicativo permitir o upload de arquivos (por exemplo, o atacante pode carregar um script JSP disfar\u00e7ado como uma imagem atrav\u00e9s de um formul\u00e1rio de upload de imagem). O ataque pode ser realizado se for poss\u00edvel enviar uma solicita\u00e7\u00e3o para a porta de rede com o manipulador AJP. De acordo com informa\u00e7\u00f5es preliminares, existem na rede quatro problemas menores (inclus\u00e3o de mensagens de depura\u00e7\u00e3o, falta de bloqueio de backup por meio da ferramenta ADB, criptografia de configura\u00e7\u00f5es com uma chave predefinida, aus\u00eancia de v\u00ednculo do certificado SSL) e uma vulnerabilidade de gravidade m\u00e9dia (encerramento incompleto da sess\u00e3o, permitindo a reutiliza\u00e7\u00e3o de tokens de sess\u00e3o).<\/a><\/noindex> mais de 1,2 milh\u00e3o de hosts aceitando solicita\u00e7\u00f5es via protocolo AJP. <\/p>\n

A vulnerabilidade est\u00e1 presente no protocolo AJP, mas n\u00e3o \u00e9 causada<\/a><\/noindex> por um erro na implementa\u00e7\u00e3o. Al\u00e9m de aceitar conex\u00f5es via HTTP (porta 8080), o Apache Tomcat, por padr\u00e3o, permite o acesso ao aplicativo web atrav\u00e9s do protocolo AJP (Apache Jserv Protocol<\/a><\/noindex>, porta 8009), que \u00e9 uma alternativa bin\u00e1ria otimizada para alcan\u00e7ar maior desempenho, geralmente utilizada na cria\u00e7\u00e3o de clusters de servidores Tomcat ou para acelerar a intera\u00e7\u00e3o com Tomcat em um proxy reverso ou balanceador de carga.<\/p>\n

O AJP fornece uma funcionalidade padr\u00e3o para acessar arquivos no servidor, que pode ser usada, entre outras coisas, para obter arquivos que n\u00e3o deveriam ser divulgados. Sup\u00f5e-se que o acesso ao AJP esteja aberto apenas para servidores de confian\u00e7a, mas na realidade, na configura\u00e7\u00e3o padr\u00e3o, o Tomcat estava configurado para iniciar o manipulador em todas as interfaces de rede, e as solicita\u00e7\u00f5es eram aceitas sem autentica\u00e7\u00e3o. O acesso era poss\u00edvel a quaisquer arquivos do aplicativo web, incluindo o conte\u00fado de WEB-INF, META-INF e quaisquer outros diret\u00f3rios acessados atrav\u00e9s da chamada ServletContext.getResourceAsStream(). O AJP tamb\u00e9m permite que qualquer arquivo nos diret\u00f3rios dispon\u00edveis para o aplicativo web seja usado como um script JSP.<\/p>\n

O problema aparece a partir da vers\u00e3o do Tomcat 6.x, lan\u00e7ada h\u00e1 13 anos. Al\u00e9m do pr\u00f3prio Tomcat, o problema afeta<\/a><\/noindex> e os produtos que o utilizam, como o Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP), assim como aplica\u00e7\u00f5es web autossuficientes que utilizam Spring Boot<\/a><\/noindex>. Uma vulnerabilidade semelhante (CVE-2020-1745) est\u00e3o presentes<\/a><\/noindex> no servidor web Undertow<\/a><\/noindex>, usado no servidor de aplica\u00e7\u00f5es Wildfly. No JBoss e Wildfly, o protocolo AJP est\u00e1 habilitado por padr\u00e3o apenas nos perfis standalone-full-ha.xml, standalone-ha.xml e ha\/full-ha no domain.xml. No Spring Boot, o suporte a AJP est\u00e1 desabilitado por padr\u00e3o. Atualmente, diversos grupos prepararam mais de uma dezena de exemplos funcionais de exploits (
\n 1<\/a><\/noindex>,
\n 2<\/a><\/noindex>,
\n 3<\/a><\/noindex>,
\n 4<\/a><\/noindex>,
\n 5<\/a><\/noindex>,
\n 6<\/a><\/noindex>,
\n 7<\/a><\/noindex>,
\n 8<\/a><\/noindex>,
\n 9<\/a><\/noindex>,
\n 10<\/a><\/noindex>,
\n 11<\/a><\/noindex>). <\/p>\n

A vulnerabilidade foi corrigida nas vers\u00f5es do Tomcat 9.0.31<\/a><\/noindex>, 8.5.51<\/a><\/noindex> e 7.0.100<\/a><\/noindex> ((manuten\u00e7\u00e3o da ramifica\u00e7\u00e3o 6.x encerrado<\/a><\/noindex>). \u00c9 poss\u00edvel acompanhar o lan\u00e7amento de atualiza\u00e7\u00f5es nas distribui\u00e7\u00f5es atrav\u00e9s dessas p\u00e1ginas: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. Como uma medida alternativa de seguran\u00e7a, voc\u00ea pode desativar o servi\u00e7o Tomcat AJP Connector (vincular o socket de escuta ao localhost ou comentar a linha com Connector port = '8009'), se n\u00e3o houver necessidade dele, ou a p\u00e1gina inicial e o mecanismo de busca.<\/a><\/noindex> acesso autenticado usando os atributos 'secret' e 'address', se o servi\u00e7o for utilizado para intera\u00e7\u00f5es com outros servidores e proxies baseados em mod_jk e mod_proxy_ajp (mod_cluster n\u00e3o suporta autentica\u00e7\u00e3o). <\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1938) \u0432 Apache Tomcat, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 Java Servlet, JavaServer Pages, Java Expression Language \u0438 Java WebSocket. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ghostcat \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 CVSS). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u043e\u0440\u0442\u0443 8009 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72053","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilidade no Apache Tomcat que permite a inje\u00e7\u00e3o de c\u00f3digo JSP e acesso a arquivos de aplica\u00e7\u00f5es web | ProHoster","description":"Pesquisadores da empresa chinesa Chaitin Tech identificaram uma vulnerabilidade (","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Tomcat, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c JSP-\u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T05:42:47+00:00","article:modified_time":"2020-03-03T13:10:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72053","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-08 06:25:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/72053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=72053"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/72053\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=72053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=72053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=72053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}