Tuesday, November 5, 2024
HomeCVE/vulnerability13-year-old Ghostcat Bug Affected Apache-Tomcat Let Hackers Remotely Inject Any Files in...

13-year-old Ghostcat Bug Affected Apache-Tomcat Let Hackers Remotely Inject Any Files in The Servers

Published on

Malware protection

Ghostcat, 13-Year old severe file inclusion vulnerability affected Apache-Tomcat server allows hackers to read or include any files in the web app directories of Tomcat remotely.

Tomcat is one of the most popular Java middleware servers that used to deploy Java Servlets and JSPs, also it provides a “pure Java” HTTP web server environment in which Java code can run.

Critical Ghostcat Vulnerability initially discovered by a researcher from Chaitin Tech and the bug is specifically existing in the Tomcat AJP protocol.

- Advertisement - SIEM as a Service

AJP protocol is a binary protocol that can proxy inbound requests from a web server through to an application server that sits behind the webserver.

The vulnerability can be tracked as CVE-2020-1938 and it affected all versions of Tomcat 9/8/7/6.

Affected Tomcat version:

  • Apache Tomcat 9.x < 9.0.31
  • Apache Tomcat 8.x < 8.5.51
  • Apache Tomcat 7.x < 7.0.100
  • Apache Tomcat 6.x

Ghostcat is a high-risk file read/include vulnerability in Tomcat, and it allows an attacker to execute malicious code on the target host by exploiting file inclusion flaw.

In other words, Ghostcat vulnerability allows an attacker to read the configuration files and source code files of all webapps that deployed in Tomcat, and if the web app allows a file upload due to this severe flaw, the attacker is also able to upload any files to the server.

It also lets attackers upload any malicious Java Server Pages (JSP) that enable remote code execution on the server.

According to the Researcher from Chaitin Tech, Under the following circumstances can Tomcat be exploited.

=>  If the AJP Connector is enabled and the attacker can access the 
AJP Connector service port, there is a risk of be exploited by
the Ghostcat vulnerability.
=> It should be noted that Tomcat AJP Connector is enabled by default
and listens at 0.0.0.0:8009.

Chaitin Tech reported this severe vulnerability to Apache Tomcat official on 2020/01/03 and the Apache Tomcat fixed the bug and released 9.0.31 and 8.5.51 version.

You can read the Ghostcat vulnerability patch notice from Apache for Tomcat 7.xTomcat 8.x, and Tomcat 9.x 

You can also Utilize xray vulnerability scanner from Chaitin Tech to detect Ghostcat Vulnerability.

Also Read: Most Important Web Server Penetration Testing Checklist

Follow us on Twitter, Linkedin, Facebook for Daily cyber security & hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

ClickFix Exploits GMeet & Zoom Pages to Deliver Sophisticated Malware

A new tactic, "ClickFix," has emerged. It exploits fake Google Meet and Zoom pages...

APT36 Hackers Attacking Windows Deevices With ElizaRAT

APT36, a sophisticated threat actor, has been actively targeting Indian entities with advanced malware...

Hackers Using AV/EDR Bypass Tool From Cybercrime Forums To Bypass Endpoints

Researchers uncovered two previously unknown endpoints with older Cortex XDR agents that used to...

Hackers Created 100+ Fake Web Stores To Steal Millions Of Dollars From Customers

The Phish, 'n' Ships fraud operation leverages, compromised websites to redirect users to fake...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Google Patched 40 Security Vulnerabilities Along With Two Zero-Days

Google has released a batch of security updates addressing 40 vulnerabilities, two of which...

A Massive Hacking Toolkit From “You Dun” Threat Group Developed To Lauch Massive Cyber Attack

The "You Dun" hacking group exploited vulnerable Zhiyuan OA software using SQL injection, leveraging...

Okta Verify Agent for Windows Flaw Let Attackers Steal User Passwords

A newly discovered vulnerability in Okta's Device Access features for Windows could allow attackers...