| |
HB1PMS > TECH 29.02.20 20:42l 62 Lines 2952 Bytes #999 (0) @ WW
BID : 2283HB1PMS
Read: GAST
Subj: New High-Risk Vulnerability Affects Servers Runnin
Path: DBO595<DBX320<FRB024<NL3TD<NL3PRC<GY1BBS<HB1BBS
Sent: 200229/1601Z 8600@HB1BBS.ZL.NLD.EU BPQ6.0.19
Van: HB1PMS@HB1BBS.ZL.NLD.EU
GhostCat: New High-Risk Vulnerability Affects Servers Running Apache Tomcat
apache tomcat security
If your web server is running on Apache Tomcat, you should immediately
install the latest available version of the server application to prevent
hackers from taking unauthorized control over it.
Yes, that's possible because all versions (9.x/8.x/7.x/6.x) of the Apache
Tomcat released in the past 13 years have been found vulnerable to a new
high-severity (CVSS 9.8) 'file read and inclusion bug'—which can be
exploited in the default configuration.
But it's more concerning because several proof-of-concept exploits (1, 2, 3,
4 and more) for this vulnerability have also been surfaced on the Internet,
making it easy for anyone to hack into publicly accessible vulnerable web
servers.
Dubbed 'Ghostcat' and tracked as CVE-2020-1938, the flaw could let
unauthenticated, remote attackers read the content of any file on a
vulnerable web server and obtain sensitive configuration files or source
code, or execute arbitrary code if the server allows file upload, as shown
in a demo below.
What is Ghostcat Flaw And How Does it Work?
According to Chinese cybersecurity company Chaitin Tech, the vulnerability
resides in the AJP protocol of Apache Tomcat software that arises due to
improper handling of an attribute.
"If the site allows users upload file, an attacker can first upload a file
containing malicious JSP script code to the server (the uploaded file itself
can be of any filetype, such as pictures, plain text files, etc.), and then
include the uploaded file by exploiting the Ghostcat, which finally can
result in remote code execution," the researchers said.
Apache JServ Protocol (AJP) protocol is basically an optimized version of
the HTTP protocol to allow Tomcat to communicate with an Apache web-server.
apache tomcat hacking
Though AJP protocol comes enabled by default and listens at TCP port 8009,
it is bound to IP address 0.0.0.0 and can only be exploited remotely when
accessible to untrusted clients.
73 Henk.
======================================================================
_ _ ____ __ ____ ____ _____
| | | | _ \/_ | _ \| _ \ / ____| SYS: Henk (hb1nos@hb1bbs.com)
| |__| | |_) || | |_) | |_) | (___ QTH: Ouwerkerk - JO11XO
| __ | _ < | | _ <| _ < \___ \ BBS: HB1BBS.ZLD.NLD.EU
| | | | |_) || | |_) | |_) |____) | QRV: 27.235 MHz (FM 1200bps)
|_| |_|____/ |_|____/|____/|_____/ WEB: www.hb1bbs.com
======================================================================
** Host of BPQ Netrom/Node NLDHUB::NL9HUB 85.214.163.10 UDP 93
======================================================================
** This message is generated with Sally 7.2.033
----------------------------------------------------------------------
** Timed zaterdag 29 februari 2020 17:00 West-Europa (standaardtijd)
** BBS HB1PMS@HB1BBS.ZL.NLD.EU
Lese vorherige Mail | Lese naechste Mail
| |