Ho ba kotsing ho Apache Tomcat e lumellang ho kenya khoutu ea JSP le ho fumana lifaele tsa kopo ea webo

Bafuputsi ba k'hamphani ea Chaena ea Chaitin Tech ba fumane bofokodi (CVE-2020-1938) ho Apache Tomcat, ts'ebetsong e bulehileng ea Java Servlet, JavaServer Pages, Java Expression Language le theknoloji ea Java WebSocket. Ho ba kotsing ho filoe lebitso la khoutu Ghostcat le boemo bo boima (9.8 CVSS). Bothata bo lumella, ka tlhophiso ea kamehla, ka ho romela kopo ho marang-rang a marang-rang 8009, ho bala litaba tsa lifaele leha e le life tse tsoang bukeng ea kopo ea websaete, ho kenyeletsa lifaele tse nang le litlhophiso le mekhoa ea mohloli oa kopo.

Kotsi e boetse e etsa hore ho khonehe ho kenya lifaele tse ling ka har'a khoutu ea kopo, e lumellang hore ho sebelisoe khoutu ho seva haeba kopo e lumella lifaele hore li kenngoe ho seva (mohlala, mohlaseli a ka kenya script ea JSP e patiloe e le setšoantšo. foromo ea ho kenya setšoantšo). Tlhaselo e ka etsoa ha ho khoneha ho romela kopo ho sekepe sa marang-rang se nang le mohlokomeli oa AJP. Ho latela data ea pele, inthaneteng fumanehile baamoheli ba fetang limilione tse 1.2 ba amohelang likopo ka protocol ea AJP.

Kotsi e teng ho protocol ea AJP, le ha e bitsoe phoso ts'ebetsong. Ntle le ho amohela likhokahano ka HTTP (port 8080), Apache Tomcat ka boiketsetso e lumella ho fihlella ts'ebeliso ea webo ka protocol ea AJP (Apache Jserv Protocol, port 8009), e leng analogue ea binary ea HTTP e ntlafalitsoeng bakeng sa ts'ebetso e phahameng, hangata e sebelisoang ha ho etsoa sehlopha sa li-server tsa Tomcat kapa ho potlakisa ho sebelisana le Tomcat ho proxy e ka morao kapa ho leka-lekanya mojaro.

AJP e fana ka ts'ebetso e tloaelehileng ea ho fumana lifaele ho seva, tse ka sebelisoang, ho kenyelletsa le ho fumana lifaele tse ke keng tsa hlahisoa. AJP e tlameha ho fumaneha feela ho li-server tse tšeptjoang, empa ha e le hantle, tlhophiso ea kamehla ea Tomcat e ile ea tsamaisa sebatli ho li-interfaces tsohle tsa marang-rang le ho amohela likopo ntle le bopaki. Ho khoneha ho fihlella lifaele tsa kopo ea tepo, ho kenyeletsoa le litaba tsa WEB-INF, META-INF le li-directory life kapa life tse fanoeng ka mohala ho ServletContext.getResourceAsStream(). AJP e boetse e u lumella ho sebelisa faele efe kapa efe ho li-directory tse fumanehang ho sesebelisoa sa webo joalo ka sengoloa sa JSP.

Bothata bona esale bo hlaha ho tloha ha lekala la Tomcat 13.x le lokolloa lilemong tse 6 tse fetileng. Ntle le bothata ba Tomcat ka boeona ama le lihlahisoa tse e sebelisang, tse kang Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP), hammoho le lisebelisoa tsa marang-rang tse ikemetseng tse sebelisang Boot ea selemo. Ts'ireletso e ts'oanang (CVE-2020-1745) teng mocheng oa marang-rang Undertow, e sebelisoang ho seva sa kopo ea Wildfly. Ho JBoss le Wildfly, AJP e nolofalloa ka mokhoa o ikhethileng feela ka profaele e ikemetseng-full-ha.xml, standalone-ha.xml le ha/full-ha ho domain.xml. Ho Spring Boot, tšehetso ea AJP e holofalitsoe ke kamehla. Hajoale, lihlopha tse fapaneng li lokiselitse mehlala e fetang leshome le metso e 'meli ea mesebetsi e mengata (
1,
2,
3,
4,
5,
6,
7,
8,
9,
10,
11).

Ho ba kotsing ho kentsoe likhatisong tsa Tomcat 9.0.31, 8.5.51 и 7.0.100 (tlhokomelo ea lekala la 6.x khaotsoe). O ka latela ho fumaneha ha lintlafatso ho lisebelisoa tsa kabo maqepheng ana: Debian, Botho, RHEL, Fedora, sebelisa, FreeBSD. Joalo ka mokhoa oa ho sebetsa, o ka tima ts'ebeletso ea Sehokelo sa Tomcat AJP (tlama sokete ea ho mamela ho localhost kapa ho fana ka maikutlo ka mohala ka Connector port = "8009") haeba e sa hlokehe, kapa beha phihlello e netefalitsoeng o sebelisa litšoaneleho tsa "sephiri" le "aterese", haeba ts'ebeletso e sebelisoa ho sebelisana le li-server tse ling le li-proxies tse thehiloeng ho mod_jk le mod_proxy_ajp (mod_cluster ha e tšehetse netefatso).

Source: opennet.ru