{"id":72053,"date":"2020-03-01T08:42:47","date_gmt":"2020-03-01T05:42:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij"},"modified":"2020-03-03T16:10:21","modified_gmt":"2020-03-03T13:10:21","slug":"uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","title":{"rendered":"O vulnerabilitate \u00een Apache Tomcat care permite inserarea de cod JSP \u0219i ob\u021binerea fi\u0219ierelor aplica\u021biilor web","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la compania chinez\u0103 Chaitin Tech au identificat vulnerabilitatea<\/a><\/noindex> (CVE-2020-1938<\/a><\/noindex>) \u00een Apache Tomcat<\/a><\/noindex>, o implementare deschis\u0103 a tehnologiilor Java Servlet, JavaServer Pages, Java Expression Language \u0219i Java WebSocket. Vulnerabilitatea a fost denumit\u0103 Ghostcat \u0219i are un nivel critic de pericol (9.8 CVSS). Problema permite, \u00een configura\u021bia implicit\u0103, citirea con\u021binutului oric\u0103ror fi\u0219iere din directorul aplica\u021biei web prin trimiterea unei cereri pe portul de re\u021bea 8009, inclusiv fi\u0219iere de configurare \u0219i cod surs\u0103 al aplica\u021biei.<\/p>\n

Vulnerabilitatea ofer\u0103, de asemenea, posibilitatea de a importa alte fi\u0219iere \u00een codul aplica\u021biei, permi\u021b\u00e2nd executarea codului pe server, dac\u0103 aplica\u021bia permite \u00eenc\u0103rcarea de fi\u0219iere pe server (de exemplu, atacatorul poate \u00eenc\u0103rca un script JSP sub forma unei imagini printr-un formular de \u00eenc\u0103rcare). Atacul poate fi efectuat atunci c\u00e2nd se poate trimite o cerere pe portul de re\u021bea cu un handler AJP. Potrivit datelor preliminare, \u00een re\u021bea au fost g\u0103site<\/a><\/noindex> peste 1.2 milioane de gazde care accept\u0103 cereri prin protocolul AJP. <\/p>\n

Vulnerabilitatea este prezent\u0103 \u00een protocolul AJP, iar nu este cauzat\u0103<\/a><\/noindex> de o eroare \u00een implementare. \u00cen plus fa\u021b\u0103 de acceptarea conexiunilor prin HTTP (portul 8080), Apache Tomcat permite, \u00een mod implicit, accesul la aplica\u021bia web prin protocolul AJP (Apache Jserv Protocol<\/a><\/noindex>, port 8009), care reprezint\u0103 un analog binar optimizat pentru performan\u021b\u0103 mai mare al HTTP, utilizat de obicei \u00een crearea unui cluster de servere Tomcat sau pentru \u00eembun\u0103t\u0103\u021birea interac\u021biunii cu Tomcat pe un proxy invers sau un balansor de sarcin\u0103.<\/p>\n

AJP ofer\u0103 o func\u021bie standard pentru accesarea fi\u0219ierelor pe server, care poate fi utilizat\u0103 inclusiv pentru ob\u021binerea fi\u0219ierelor care nu ar trebui dezv\u0103luite. Se sub\u00een\u021belege c\u0103 accesul la AJP este deschis doar pentru servere de \u00eencredere, dar \u00een practic\u0103, \u00een configura\u021bia implicit\u0103, Tomcat a fost configurat s\u0103 ruleze handler-ul pe toate interfe\u021bele de re\u021bea, iar cererile au fost acceptate f\u0103r\u0103 autentificare. Accesul este posibil la orice fi\u0219ier din aplica\u021bia web, inclusiv con\u021binutul din WEB-INF, META-INF \u0219i orice alte directoare livrate prin apelul ServletContext.getResourceAsStream(). AJP permite, de asemenea, utilizarea oric\u0103rui fi\u0219ier din directoarele disponibile pentru aplica\u021bia web ca script JSP.<\/p>\n

Problema apare \u00eencep\u00e2nd cu ramura Tomcat 6.x, lansat\u0103 acum 13 ani. Pe l\u00e2ng\u0103 Tomcat, problema implic\u0103<\/a><\/noindex> \u0219i produsele sale, cum ar fi Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP), precum \u0219i aplica\u021biile web autonome care utilizeaz\u0103 Spring Boot<\/a><\/noindex>. O vulnerabilitate similar\u0103 (CVE-2020-1745) exist\u0103<\/a><\/noindex> \u00een serverul web Undertow<\/a><\/noindex>, utilizat \u00een serverul de aplica\u021bii Wildfly. \u00cen JBoss \u0219i Wildfly, protocolul AJP este activat \u00een mod implicit doar \u00een fi\u0219ierele standalone-full-ha.xml, standalone-ha.xml \u0219i ha\/full-ha din domain.xml. \u00cen Spring Boot, suportul pentru AJP este dezactivat \u00een mod implicit. \u00cen prezent, diferite grupuri au preg\u0103tit mai mult de zece exemple de exploatare (
\n 1<\/a><\/noindex>,
\n 2<\/a><\/noindex>,
\n 3<\/a><\/noindex>,
\n 4<\/a><\/noindex>,
\n 5<\/a><\/noindex>,
\n 6<\/a><\/noindex>,
\n 7<\/a><\/noindex>,
\n 8<\/a><\/noindex>,
\n 9<\/a><\/noindex>,
\n 10<\/a><\/noindex>,
\n 11<\/a><\/noindex>). <\/p>\n

Vulnerabilitatea a fost eliminat\u0103 \u00een versiunile Tomcat 9.0.31<\/a><\/noindex>, 8.5.51<\/a><\/noindex> \u0219i 7.0.100<\/a><\/noindex> (\u00eentre\u021binerea ramurii 6.x au fost suspendate<\/a><\/noindex>). Actualiz\u0103rile \u00een distribu\u021bii pot fi urm\u0103rite pe aceste pagini: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. Ca m\u0103sur\u0103 temporar\u0103 de protec\u021bie, se poate dezactiva serviciul Tomcat AJP Connector (asociaz\u0103 socket-ul de ascultare cu localhost sau comenteaz\u0103 linia cu Connector port = \u201e8009\u201d), dac\u0103 nu este necesar, sau pagina de start \u0219i motorul de c\u0103utare.<\/a><\/noindex> acces autentificat prin intermediul atributelor \u201esecret\u201d \u0219i \u201eaddress\u201d, dac\u0103 serviciul este folosit pentru interac\u021biunea cu alte servere \u0219i proxy-uri bazate pe mod_jk \u0219i mod_proxy_ajp (mod_cluster nu suport\u0103 autentificarea). <\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1938) \u0432 Apache Tomcat, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 Java Servlet, JavaServer Pages, Java Expression Language \u0438 Java WebSocket. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ghostcat \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 CVSS). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u043e\u0440\u0442\u0443 8009 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72053","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een Apache Tomcat care permite inserarea codului JSP \u0219i ob\u021binerea fi\u0219ierelor aplica\u021biilor web | ProHoster","description":"Cercet\u0103torii de la compania chinez\u0103 Chaitin Tech au identificat o vulnerabilitate (","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Tomcat, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c JSP-\u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T05:42:47+00:00","article:modified_time":"2020-03-03T13:10:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72053","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-08 06:25:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/72053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=72053"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/72053\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=72053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=72053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=72053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}