{"id":72053,"date":"2020-03-01T08:42:47","date_gmt":"2020-03-01T05:42:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij"},"modified":"2020-03-03T16:10:21","modified_gmt":"2020-03-03T13:10:21","slug":"uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","title":{"rendered":"Zranite\u013enos\u0165 v Apache Tomcat, ktor\u00e1 umo\u017e\u0148uje vlo\u017ei\u0165 JSP k\u00f3d a z\u00edska\u0165 s\u00fabory webov\u00fdch aplik\u00e1ci\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vedci z \u010d\u00ednskej spolo\u010dnosti Chaitin Tech odhalili zranite\u013enos\u0165<\/a><\/noindex> (CVE-2020-1938<\/a><\/noindex>) v Apache Tomcat<\/a><\/noindex>, otvorenej implement\u00e1cii technol\u00f3gi\u00ed Java Servlet, JavaServer Pages, Java Expression Language a Java WebSocket. Zranite\u013enosti bolo pridelen\u00e9 k\u00f3dov\u00e9 meno Ghostcat a bola vyhodnoten\u00e1 ako kritick\u00e1 (9.8 CVSS). Probl\u00e9m umo\u017e\u0148uje v predvolenom nastaven\u00ed prostredn\u00edctvom odoslania po\u017eiadavky na sie\u0165ov\u00fd port 8009 pre\u010d\u00edta\u0165 obsah ak\u00fdchko\u013evek s\u00faborov z adres\u00e1ra webovej aplik\u00e1cie, vr\u00e1tane s\u00faborov s nastaveniami a zdrojov\u00fdch k\u00f3dov aplik\u00e1cie.<\/p>\n

Zranite\u013enos\u0165 takisto umo\u017e\u0148uje importova\u0165 in\u00e9 s\u00fabory do k\u00f3du aplik\u00e1cie, \u010do umo\u017e\u0148uje vykonanie k\u00f3du na serveri, ak aplik\u00e1cia dovo\u013euje nahr\u00e1vanie s\u00faborov na server (napr\u00edklad \u00fato\u010dn\u00edk m\u00f4\u017ee nahr\u00e1va\u0165 JSP skript pod z\u00e1mienkou obr\u00e1zka cez formul\u00e1r na nahr\u00e1vanie obr\u00e1zkov). \u00datok m\u00f4\u017ee by\u0165 vykonan\u00fd pri mo\u017enosti odoslania po\u017eiadavky na sie\u0165ov\u00fd port s AJP spracova\u010dom. Pod\u013ea predbe\u017en\u00fdch \u00fadajov sa v sieti boli zisten\u00e9<\/a><\/noindex> nach\u00e1dza viac ako 1.2 mili\u00f3na hostite\u013eov, ktor\u00e9 prij\u00edmaj\u00fa po\u017eiadavky prostredn\u00edctvom protokolu AJP. <\/p>\n

Zranite\u013enos\u0165 je pr\u00edtomn\u00e1 v protokole AJP a nie je sp\u00f4soben\u00e1<\/a><\/noindex> chybnou implement\u00e1ciou. Okrem prij\u00edmania pripojen\u00ed cez HTTP (port 8080) Apache Tomcat v predvolenom nastaven\u00ed umo\u017e\u0148uje pr\u00edstup k webovej aplik\u00e1cii prostredn\u00edctvom protokolu AJP (Apache Jserv Protocol<\/a><\/noindex>, port 8009), ktor\u00fd predstavuje optimalizovan\u00fd pre dosiahnutie vy\u0161\u0161ej v\u00fdkonnosti bin\u00e1rny ekvivalent HTTP, be\u017ene pou\u017e\u00edvan\u00fd pri vytv\u00e1ran\u00ed klastrov z Tomcat serverov alebo na zr\u00fdchlenie interakcie s Tomcat na reverznej br\u00e1ne alebo vyva\u017eova\u010di z\u00e1\u0165a\u017ee.<\/p>\n

AJP poskytuje nat\u00edvnu funkciu na pr\u00edstup k s\u00faborom na serveri, ktor\u00fa je mo\u017en\u00e9 vyu\u017ei\u0165 vr\u00e1tane z\u00edskavania s\u00faborov, ktor\u00e9 sa nemaj\u00fa zverej\u0148ova\u0165. Predpoklad\u00e1 sa, \u017ee pr\u00edstup k AJP je otvoren\u00fd iba pre d\u00f4veryhodn\u00e9 servery, ale v skuto\u010dnosti bola v predvolenom nastaven\u00ed Tomcat spracova\u010d spusten\u00fd na v\u0161etk\u00fdch sie\u0165ov\u00fdch rozhraniach a po\u017eiadavky boli prij\u00edman\u00e9 bez overenia. Pr\u00edstup je mo\u017en\u00fd k ak\u00fdmko\u013evek s\u00faborom webovej aplik\u00e1cie, vr\u00e1tane obsahu WEB-INF, META-INF a ak\u00fdchko\u013evek in\u00fdch adres\u00e1rov, ktor\u00e9 s\u00fa spr\u00edstupnen\u00e9 prostredn\u00edctvom volania ServletContext.getResourceAsStream(). AJP takisto umo\u017e\u0148uje pou\u017e\u00edva\u0165 ak\u00fdko\u013evek s\u00fabor v dostupn\u00fdch adres\u00e1roch webovej aplik\u00e1cie ako JSP skript.<\/p>\n

Probl\u00e9m sa prejavuje od vydania pred 13 rokmi v verzii Tomcat 6.x. Okrem samotn\u00e9ho Tomcat, probl\u00e9m t\u00fdka<\/a><\/noindex> a produkty, ktor\u00e9 ho vyu\u017e\u00edvaj\u00fa, ako Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP), ako aj samostatn\u00e9 webov\u00e9 aplik\u00e1cie, ktor\u00e9 pou\u017e\u00edvaj\u00fa Spring Boot<\/a><\/noindex>. Podobn\u00e1 zranite\u013enos\u0165 (CVE-2020-1745) je pr\u00edtomn\u00e1<\/a><\/noindex> v webovom serveri Undertow<\/a><\/noindex>, pou\u017eitom v aplika\u010dnom serveri Wildfly. V JBoss a Wildfly je protokol AJP predvolene povolen\u00fd iba v standalone-full-ha.xml, standalone-ha.xml a ha\/full-ha profiloch v domain.xml. V Spring Boote je podpora AJP predvolene vypnut\u00e1. V s\u00fa\u010dasnosti pripravili r\u00f4zne skupiny viac ako tucet funk\u010dn\u00fdch pr\u00edkladov exploitov (
\n 1<\/a><\/noindex>,
\n 2<\/a><\/noindex>,
\n 3<\/a><\/noindex>,
\n 4<\/a><\/noindex>,
\n 5<\/a><\/noindex>,
\n 6<\/a><\/noindex>,
\n 7<\/a><\/noindex>,
\n 8<\/a><\/noindex>,
\n 9<\/a><\/noindex>,
\n 10<\/a><\/noindex>,
\n 11<\/a><\/noindex>). <\/p>\n

Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 vo verzi\u00e1ch Tomcat 9.0.31<\/a><\/noindex>, 8.5.51<\/a><\/noindex> a 7.0.100<\/a><\/noindex> (\u00fadr\u017eba vetvy 6.x bol ukon\u010den\u00fd<\/a><\/noindex>). Sledova\u0165 vznik aktualiz\u00e1cie v distrib\u00faci\u00e1ch je mo\u017en\u00e9 na t\u00fdchto str\u00e1nkach: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. Ako obch\u00e1dzaj\u00face rie\u0161enie ochrany m\u00f4\u017eete vypn\u00fa\u0165 slu\u017ebu Tomcat AJP Connector (priradi\u0165 po\u010d\u00favaj\u00faci socket k localhostu alebo zakomentova\u0165 riadok s Connector port = «8009»), ak nie je potrebn\u00fd, alebo nastavi\u0165<\/a><\/noindex> autentifikovan\u00fd pr\u00edstup pomocou atrib\u00fatov «secret» a «address», ak je slu\u017eba pou\u017e\u00edvan\u00e1 na interakciu s in\u00fdmi servermi a proxy na b\u00e1ze mod_jk a mod_proxy_ajp (mod_cluster autentifik\u00e1ciu nepodporuje). <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1938) \u0432 Apache Tomcat, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 Java Servlet, JavaServer Pages, Java Expression Language \u0438 Java WebSocket. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ghostcat \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 CVSS). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u043e\u0440\u0442\u0443 8009 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72053","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v Apache Tomcat, ktor\u00e1 umo\u017e\u0148uje vlo\u017ei\u0165 JSP k\u00f3d a z\u00edska\u0165 s\u00fabory webov\u00fdch aplik\u00e1ci\u00ed | ProHoster","description":"V\u00fdskumn\u00edci z \u010d\u00ednskej spolo\u010dnosti Chaitin Tech odhalili zranite\u013enos\u0165 (","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Tomcat, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c JSP-\u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T05:42:47+00:00","article:modified_time":"2020-03-03T13:10:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72053","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-08 06:25:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/72053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=72053"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/72053\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=72053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=72053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=72053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}