Severity

High

Analysis Summary

Ongoing scans for Apache Tomcat servers unpatched against the Ghostcat vulnerability that allows potential attackers to take over servers have been detected over the weekend. Researchers said “mass scanning activity targeting this vulnerability has already begun. PATCH NOW!”

CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. Prior to Tomcat 7.0.100, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required.

Impact

Server takeover

Affected Vendors

Apache Tomcat

Affected Products

All unpatched Apache Tomcat 6 7 8 and 9 installations ship with AJP Connector enabled by default.

Remediation