GhostCat: New High-Risk Vulnerability Affects Servers Running Apache Tomcat

guest · Feb 28, 2020

GhostCat: New High-Risk Vulnerability Affects Servers Running Apache Tomcat
February 28, 2020
https://thehackernews.com/2020/02/ghostcat-new-high-risk-vulnerability.html

If your web server is running on Apache Tomcat, you should immediately install the latest available version of the server application to prevent hackers from taking unauthorized control over it.

Yes, that's possible because all versions (9.x/8.x/7.x/6.x) of the Apache Tomcat released in the past 13 years have been found vulnerable to a new high-severity (CVSS 9.8) 'file read and inclusion bug'—which can be exploited in the default configuration.
But it's more concerning because several proof-of-concept exploits (1, 2, 3, 4 and more) for this vulnerability have also been surfaced on the Internet, making it easy for anyone to hack into publicly accessible vulnerable web servers.
What is Ghostcat Flaw And How Does it Work?
According to Chinese cybersecurity company Chaitin Tech, the vulnerability resides in the AJP protocol of Apache Tomcat software that arises due to improper handling of an attribute.
Click to expand...

Apache Tomcat Vulnerability: Patch and Mitigation
Chaitin researchers found and reported this flaw last month to the Apache Tomcat project, who has now released Apache Tomcat 9.0.31, 8.5.51, and 7.0.100 versions to patch the issue.

The latest releases also fix 2 other low severity HTTP request smuggling (CVE-2020-1935 and CVE-2019-17569) issues.
Click to expand...

guest · Mar 2, 2020

Active Scans for Apache Tomcat Ghostcat Vulnerability Detected, Patch Now
March 2, 2020
https://www.bleepingcomputer.com/ne...at-ghostcat-vulnerability-detected-patch-now/

Ongoing scans for Apache Tomcat servers unpatched against the Ghostcat vulnerability that allows potential attackers to take over servers have been detected over the weekend.
As cyber threat intelligence firm Bad Packets said on Saturday, "mass scanning activity targeting this vulnerability has already begun. PATCH NOW!"
Proof-of-concept exploits available
Tenable says that proof-of-concept exploits have already been shared by security researchers on GitHub (1, 2, 3, 4, 5).

Chaitin Tech also provides a security assessment tool that will help you discover Tomcat servers vulnerable to attacks targeting Ghostcat on your network.
Critical flaw that can lead to server takeover
"Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection," the developers explain. "If such connections are available to an attacker, they can be exploited in ways that may be surprising."
Click to expand...

guest · Mar 24, 2020

Apache Tomcat Exploit Poised to Pounce, Stealing Files
March 23, 2020
https://threatpost.com/apache-tomcat-exploit-stealing-files/154055/

A vulnerability in the popular Apache Tomcat web server is ripe for active attack, thanks to a proof-of-concept (PoC) exploit making an appearance on GitHub. The now-patched bug affects Tomcat versions 7.0, 8.5 and 9.0.

According to Flashpoint analysts Cheng Lu and Steven Ouellette, an exploit for the “Ghostcat,” security bug (tracked as CVE-2020-1938 and first publicly disclosed Feb. 20) reliably allows information disclosure via file retrieval on a vulnerable server – without authentication or a user being tricked into a compromising interaction. And, in some situations, it could allow remote code execution, they said.

“Due to the nature of the vulnerability, [the exploit] can be leveraged without any user interactions and with high reliability, with low chance of causing the vulnerable server to crash,” explained the researchers, in a posting on Friday. The duo said they’ve confirmed that the PoC works.
However, in a default Tomcat installation on Windows 10, Tomcat’s AJP port, on 8009, is exposed – allowing outside users to interact with and gain access to the Tomcat server itself. The PoC exploit demonstrates how this state of affairs can be used to expose files.
Click to expand...

Remote Code Execution
The bug does open the door to RCE, according to the researchers. If a vulnerable Tomcat server also allows file uploads (not the default setting, by the way), an attacker could upload their own code via the AJP connector.
Further, the publicly available PoC code doesn’t support execution of files on a vulnerable server even with the prerequisites in place. “However, such capability can be implemented on the basis of the PoC code with relative ease,” the researchers warned.
Click to expand...

Flashpoint: Apache Tomcat Vulnerability “Ghostcat” Attracting Threat Actor Attention

Log in or Sign up

GhostCat: New High-Risk Vulnerability Affects Servers Running Apache Tomcat

guest Guest

guest Guest

guest Guest

Log in or Sign up

GhostCat: New High-Risk Vulnerability Affects Servers Running Apache Tomcat

guest Guest

guest Guest

guest Guest

Useful Searches