Tuesday, February 18, 2025
HomeCVE/vulnerability13-year-old Ghostcat Bug Affected Apache-Tomcat Let Hackers Remotely Inject Any Files in...

13-year-old Ghostcat Bug Affected Apache-Tomcat Let Hackers Remotely Inject Any Files in The Servers

Published on

SIEM as a Service

Follow Us on Google News

Ghostcat, 13-Year old severe file inclusion vulnerability affected Apache-Tomcat server allows hackers to read or include any files in the web app directories of Tomcat remotely.

Tomcat is one of the most popular Java middleware servers that used to deploy Java Servlets and JSPs, also it provides a “pure Java” HTTP web server environment in which Java code can run.

Critical Ghostcat Vulnerability initially discovered by a researcher from Chaitin Tech and the bug is specifically existing in the Tomcat AJP protocol.

AJP protocol is a binary protocol that can proxy inbound requests from a web server through to an application server that sits behind the webserver.

The vulnerability can be tracked as CVE-2020-1938 and it affected all versions of Tomcat 9/8/7/6.

Affected Tomcat version:

  • Apache Tomcat 9.x < 9.0.31
  • Apache Tomcat 8.x < 8.5.51
  • Apache Tomcat 7.x < 7.0.100
  • Apache Tomcat 6.x

Ghostcat is a high-risk file read/include vulnerability in Tomcat, and it allows an attacker to execute malicious code on the target host by exploiting file inclusion flaw.

In other words, Ghostcat vulnerability allows an attacker to read the configuration files and source code files of all webapps that deployed in Tomcat, and if the web app allows a file upload due to this severe flaw, the attacker is also able to upload any files to the server.

It also lets attackers upload any malicious Java Server Pages (JSP) that enable remote code execution on the server.

According to the Researcher from Chaitin Tech, Under the following circumstances can Tomcat be exploited.

=>  If the AJP Connector is enabled and the attacker can access the 
AJP Connector service port, there is a risk of be exploited by
the Ghostcat vulnerability.
=> It should be noted that Tomcat AJP Connector is enabled by default
and listens at 0.0.0.0:8009.

Chaitin Tech reported this severe vulnerability to Apache Tomcat official on 2020/01/03 and the Apache Tomcat fixed the bug and released 9.0.31 and 8.5.51 version.

You can read the Ghostcat vulnerability patch notice from Apache for Tomcat 7.xTomcat 8.x, and Tomcat 9.x 

You can also Utilize xray vulnerability scanner from Chaitin Tech to detect Ghostcat Vulnerability.

Also Read: Most Important Web Server Penetration Testing Checklist

Follow us on Twitter, Linkedin, Facebook for Daily cyber security & hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Highly Obfuscated .NET sectopRAT Mimic as Chrome Extension

SectopRAT, also known as Arechclient2, is a sophisticated Remote Access Trojan (RAT) developed using...

Threat Actors Trojanize Popular Games to Evade Security and Infect Systems

A sophisticated malware campaign was launched by cybercriminals, targeting users through trojanized versions of...

New Research Aims to Strengthen MITRE ATT&CK for Evolving Cyber Threats

A recent study by researchers from the National University of Singapore and NCS Cyber...

New LLM Vulnerability Exposes AI Models Like ChatGPT to Exploitation

A significant vulnerability has been identified in large language models (LLMs) such as ChatGPT,...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Juniper Issues Warning About Critical Authentication Bypass Vulnerability

Juniper Networks has issued an urgent security bulletin for its Session Smart Router, Session...

LibreOffice Vulnerabilities Allow Attackers to Write to Files and Extract Data

Two critical vulnerabilities in LibreOffice (CVE-2024-12425 and CVE-2024-12426) expose millions of users to file...

Xerox Printer Vulnerability Exposes Authentication Data Via LDAP and SMB

A critical security vulnerability in Xerox’s Versalink C7025 Multifunction Printer (MFP) has been uncovered,...