{"id":72053,"date":"2020-03-01T08:42:47","date_gmt":"2020-03-01T05:42:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij"},"modified":"2020-03-03T16:10:21","modified_gmt":"2020-03-03T13:10:21","slug":"uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","title":{"rendered":"Vulnerabilnost u Apache Tomcatu koja omogu\u0107ava umetanje JSP koda i pristup datotekama web aplikacija","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Istra\u017eiva\u010di iz kineske kompanije Chaitin Tech otkrili su ranljivost<\/a><\/noindex> (CVE-2020-1938<\/a><\/noindex>) u Apache Tomcat<\/a><\/noindex>, otvorena implementacija tehnologija Java Servlet, JavaServer Pages, Java Expression Language i Java WebSocket. Ova ranjivost nosi naziv Ghostcat i ima kriti\u010dnu opasnost (9.8 CVSS). Problem omogu\u0107ava, u zadanoj konfiguraciji, da se slanjem zahteva na mre\u017enu portu 8009 pro\u010dita sadr\u017eaj bilo koje datoteke iz direktorijuma web aplikacije, uklju\u010duju\u0107i datoteke s pode\u0161avanjima i izvorne kodove aplikacije.<\/p>\n

Ranjivost tako\u0111e omogu\u0107ava uvoz drugih datoteka u kod aplikacije, \u0161to mo\u017ee omogu\u0107iti izvr\u0161avanje koda na serveru, ako aplikacija dozvoljava u\u010ditavanje datoteka na server (na primer, napada\u010d mo\u017ee u\u010ditati JSP skript pod krinkom slike putem forme za u\u010ditavanje slika). Napad mo\u017ee biti izvr\u0161en ukoliko postoji mogu\u0107nost slanja zahteva na mre\u017eni port sa AJP obradnikom. Preliminarne informacije pokazuju da je u mre\u017ei prona\u0111eno<\/a><\/noindex> vi\u0161e od 1.2 miliona hostova koji primaju zahteve putem AJP protokola. <\/p>\n

Ranjivost se nalazi u AJP protokolu, a nije uzrokovana<\/a><\/noindex> gre\u0161kom u implementaciji. Pored prijema konekcija putem HTTP (port 8080), Apache Tomcat po zadanoj konfiguraciji omogu\u0107ava pristup web aplikacijama putem AJP protokola (Apache Jserv Protocol<\/a><\/noindex>, port 8009), koji predstavlja optimizovanu binarnu varijantu HTTP za postizanje ve\u0107e performanse, obi\u010dno kori\u0161\u0107enu prilikom kreiranja klastera Tomcat servera ili za ubrzavanje komunikacije sa Tomcat-om na obratnom proksiju ili balansiraju\u0107em optere\u0107enju.<\/p>\n

AJP pru\u017ea ugra\u0111enu funkciju za pristup datotekama na serveru, koja se mo\u017ee koristiti i za pristup datotekama koje nisu namenjene razotkrivanju. Pretpostavlja se da je pristup AJP-u otvoren samo za poverene servere, ali u praksi je u zadnjoj konfiguraciji Tomcat omogu\u0107eno pokretanje obradnika na svim mre\u017enim interfejsima, a zahtevi su primani bez autentifikacije. Pristup je mogu\u0107 do bilo koje datoteke web aplikacije, uklju\u010duju\u0107i sadr\u017eaj WEB-INF, META-INF i bilo kojih drugih direktorijuma koji se javljuju putem poziva ServletContext.getResourceAsStream(). AJP tako\u0111e omogu\u0107ava kori\u0161\u0107enje bilo koje datoteke u dostupnim direktorijumima web aplikacije kao JSP skript.<\/p>\n

Te\u017eava se pojavi \u017ee od izdaje verzije Tomcat 6.x pred 13 leti. Poleg samega Tomcata te\u017eava zadeva<\/a><\/noindex> tudi izdelke, ki temeljijo nanj, kot sta Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP), ter samostojne spletne aplikacije, ki uporabljajo Spring Boot<\/a><\/noindex>. Podobna ranljivost (CVE-2020-1745) je na voljo<\/a><\/noindex> je v spletni stre\u017enik Undertow<\/a><\/noindex>, ki se uporablja v stre\u017eniku aplikacij Wildfly. V JBoss in Wildfly je protokol AJP privzeto vklju\u010den le v konfiguracijah standalone-full-ha.xml, standalone-ha.xml in ha\/full-ha v domain.xml. V Spring Boot je podpora za AJP privzeto izklopljena. V trenutku so razli\u010dne skupine pripravile ve\u010d kot deset delovnih primerov izkori\u0161\u010danja (
\n 1<\/a><\/noindex>,
\n 2<\/a><\/noindex>,
\n 3<\/a><\/noindex>,
\n 4<\/a><\/noindex>,
\n 5<\/a><\/noindex>,
\n 6<\/a><\/noindex>,
\n 7<\/a><\/noindex>,
\n 8<\/a><\/noindex>,
\n 9<\/a><\/noindex>,
\n 10<\/a><\/noindex>,
\n 11<\/a><\/noindex>). <\/p>\n

Ranljivost je odpravljena v izdajah Tomcat 9.0.31<\/a><\/noindex>, 8.5.51<\/a><\/noindex> in 7.0.100<\/a><\/noindex> (vzdr\u017eevanje verzije 6.x prekinut<\/a><\/noindex>). Spremljanje pojavljanja posodobitev v distribucijah je mogo\u010de na teh straneh: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0439 \u043c\u0435\u0440\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0438\u0441 Tomcat AJP Connector (\u043f\u0440\u0438\u0432\u044f\u0437\u0430\u0442\u044c \u0441\u043b\u0443\u0448\u0430\u044e\u0449\u0438\u0439 \u0441\u043e\u043a\u0435\u0442 \u0441 localhost \u0438\u043b\u0438 \u0437\u0430\u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0442\u0440\u043e\u043a\u0443 \u0441 Connector port = «8009»), \u0435\u0441\u043b\u0438 \u0432 \u043d\u0451\u043c \u043d\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0438\u043b\u0438 nastavijo<\/a><\/noindex> \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u043e\u0432 «secret» \u0438 «address», \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0438\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u0438 \u043f\u0440\u043e\u043a\u0441\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 mod_jk \u0438 mod_proxy_ajp (mod_cluster \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442). <\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1938) \u0432 Apache Tomcat, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 Java Servlet, JavaServer Pages, Java Expression Language \u0438 Java WebSocket. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ghostcat \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 CVSS). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u043e\u0440\u0442\u0443 8009 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72053","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranljivost v Apache Tomcat, ki omogo\u010da vstavljanje JSP kode in dostop do datotek spletnih aplikacij | ProHoster","description":"Raziskovalci iz kitajskega podjetja Chaitin Tech so odkrili ranljivost (","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Tomcat, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c JSP-\u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T05:42:47+00:00","article:modified_time":"2020-03-03T13:10:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72053","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-08 06:25:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/72053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=72053"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/72053\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=72053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=72053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=72053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}