{"id":72053,"date":"2020-03-01T08:42:47","date_gmt":"2020-03-01T05:42:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij"},"modified":"2020-03-03T16:10:21","modified_gmt":"2020-03-03T13:10:21","slug":"uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","title":{"rendered":"S\u00e5rbarhet i Apache Tomcat som m\u00f6jligg\u00f6r ins\u00e4ttning av JSP-kod och \u00e5tkomst till filer i web-applikationer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskare fr\u00e5n det kinesiska f\u00f6retaget Chaitin Tech har uppt\u00e4ckt s\u00e5rbarhet<\/a><\/noindex> (CVE-2020-1938<\/a><\/noindex>) i Apache Tomcat<\/a><\/noindex>, en \u00f6ppen implementering av Java Servlet-teknologierna, JavaServer Pages, Java Expression Language och Java WebSocket. S\u00e5rbarheten har kodnamnet Ghostcat och har en kritisk riskniv\u00e5 (9.8 CVSS). Problemet g\u00f6r det m\u00f6jligt, i standardkonfiguration, att genom att skicka en f\u00f6rfr\u00e5gan till n\u00e4tverksport 8009, l\u00e4sa inneh\u00e5llet i alla filer fr\u00e5n webapplikationens katalog, inklusive inst\u00e4llningsfiler och k\u00e4llkoder f\u00f6r applikationen.<\/p>\n

S\u00e5rbarheten g\u00f6r ocks\u00e5 att det g\u00e5r att importera andra filer i applikationens kod, vilket m\u00f6jligg\u00f6r kodexekvering p\u00e5 servern, om applikationen till\u00e5ter filuppladdning till servern (till exempel kan en angripare ladda upp ett JSP-skript under f\u00f6rev\u00e4ndning av en bild via en bilduppladdningsformul\u00e4r). En attack kan genomf\u00f6ras om det finns m\u00f6jlighet att skicka en f\u00f6rfr\u00e5gan till n\u00e4tverksporten med AJP-hanteraren. Enligt prelimin\u00e4ra uppgifter finns det i n\u00e4tverket fanns<\/a><\/noindex> \u00f6ver 1,2 miljoner v\u00e4rdar som tar emot f\u00f6rfr\u00e5gningar via AJP-protokollet. <\/p>\n

S\u00e5rbarheten finns i AJP-protokollet, och inte orsakas av<\/a><\/noindex> ett fel i implementeringen. F\u00f6rutom att ta emot anslutningar via HTTP (port 8080) till\u00e5ter Apache Tomcat som standard \u00e5tkomst till webapplikationen genom AJP-protokollet (Apache Jserv Protocol<\/a><\/noindex>, port 8009), vilket representerar en optimerad bin\u00e4r motsvarighet till HTTP designad f\u00f6r att uppn\u00e5 h\u00f6gre prestanda, vanligtvis anv\u00e4nd vid skapande av kluster av Tomcat-servrar eller f\u00f6r att p\u00e5skynda kommunikationen med Tomcat p\u00e5 en reverse proxy eller lastbalanserare.<\/p>\n

AJP erbjuder en inbyggd funktion f\u00f6r att f\u00e5 \u00e5tkomst till filer p\u00e5 servern, vilket ocks\u00e5 kan anv\u00e4ndas f\u00f6r att h\u00e4mta filer som inte b\u00f6r avsl\u00f6jas. Det antas att \u00e5tkomsten till AJP endast \u00e4r \u00f6ppen f\u00f6r betrodda servrar, men i praktiken har Tomcats standardkonfiguration startat hanteraren p\u00e5 alla n\u00e4tverksgr\u00e4nssnitt, och f\u00f6rfr\u00e5gningar har accepterats utan autentisering. \u00c5tkomst \u00e4r m\u00f6jlig till alla filer i webapplikationen, inklusive inneh\u00e5llet i WEB-INF, META-INF och andra kataloger som f\u00f6rmedlas genom anrop av ServletContext.getResourceAsStream(). AJP till\u00e5ter ocks\u00e5 att vilken fil som helst i katalogerna som \u00e4r tillg\u00e4ngliga f\u00f6r webapplikationen anv\u00e4nds som JSP-skript.<\/p>\n

Problemet har funnits sedan den version av Tomcat 6.x som sl\u00e4pptes f\u00f6r 13 \u00e5r sedan. Ut\u00f6ver direkt Tomcat p\u00e5verkas \u00e4ven problemet. l\u00f6sningar baserade p\u00e5 det \u00f6ppna UPnP-stacket<\/a><\/noindex> och dess produkter, s\u00e5som Red Hat JBoss Web Server (JWS), JBoss Enterprise Application Platform (EAP), samt sj\u00e4lvg\u00e5ende webbapplikationer, som anv\u00e4nder Spring Boot<\/a><\/noindex>. En liknande s\u00e5rbarhet (CVE-2020-1745) \u00e4r n\u00e4rvarande<\/a><\/noindex> i webbservern Undertow<\/a><\/noindex>, som anv\u00e4nds i applikationsservern Wildfly. I JBoss och Wildfly \u00e4r AJP-protokollet som standard aktiverat endast i standalone-full-ha.xml, standalone-ha.xml och ha\/full-ha-profiler i domain.xml. I Spring Boot \u00e4r st\u00f6det f\u00f6r AJP avaktiverat som standard. F\u00f6r n\u00e4rvarande har olika grupper f\u00f6rberett fler \u00e4n ett dussin fungerande exempel p\u00e5 exploits (
\n 1<\/a><\/noindex>,
\n 2<\/a><\/noindex>,
\n 3<\/a><\/noindex>,
\n 4<\/a><\/noindex>,
\n 5<\/a><\/noindex>,
\n 6<\/a><\/noindex>,
\n 7<\/a><\/noindex>,
\n 8<\/a><\/noindex>,
\n 9<\/a><\/noindex>,
\n 10<\/a><\/noindex>,
\n 11<\/a><\/noindex>). <\/p>\n

S\u00e5rbarheten har \u00e5tg\u00e4rdats i Tomcat-versioner 9.0.31<\/a><\/noindex>, 8.5.51<\/a><\/noindex> och 7.0.100<\/a><\/noindex> (underh\u00e5llet av version 6.x avslutat<\/a><\/noindex>). H\u00e5ll koll p\u00e5 uppdateringar i distributionerna p\u00e5 f\u00f6ljande sidor: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. Som en tillf\u00e4llig skydds\u00e5tg\u00e4rd kan du st\u00e4nga av Tomcat AJP Connector-tj\u00e4nsten (binda den lyssnande socketen till localhost eller kommentera raden med Connector port = «8009»), om den inte \u00e4r n\u00f6dv\u00e4ndig, eller anpassas<\/a><\/noindex> autentiserad \u00e5tkomst med hj\u00e4lp av attributen «secret» och «address», om tj\u00e4nsten anv\u00e4nds f\u00f6r interaktion med andra servrar och proxyer baserade p\u00e5 mod_jk och mod_proxy_ajp (mod_cluster st\u00f6der inte autentisering). <\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1938) \u0432 Apache Tomcat, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 Java Servlet, JavaServer Pages, Java Expression Language \u0438 Java WebSocket. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ghostcat \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 CVSS). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u043e\u0440\u0442\u0443 8009 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u044e\u0431\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72053","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i Apache Tomcat som m\u00f6jligg\u00f6r ins\u00e4ttning av JSP-kod och \u00e5tkomst till webapplikationsfiler | ProHoster","description":"Forskare fr\u00e5n det kinesiska f\u00f6retaget Chaitin Tech har uppt\u00e4ckt en s\u00e5rbarhet (","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Tomcat, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c JSP-\u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Chaitin Tech \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-apache-tomcat-pozvolyayushhaya-podstavit-jsp-kod-i-poluchit-fajly-web-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T05:42:47+00:00","article:modified_time":"2020-03-03T13:10:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72053","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-08 06:25:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/72053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=72053"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/72053\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=72053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=72053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=72053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}