Tuesday, May 28, 2024

13-year-old Ghostcat Bug Affected Apache-Tomcat Let Hackers Remotely Inject Any Files in The Servers

Ghostcat, 13-Year old severe file inclusion vulnerability affected Apache-Tomcat server allows hackers to read or include any files in the web app directories of Tomcat remotely.

Tomcat is one of the most popular Java middleware servers that used to deploy Java Servlets and JSPs, also it provides a “pure Java” HTTP web server environment in which Java code can run.

Critical Ghostcat Vulnerability initially discovered by a researcher from Chaitin Tech and the bug is specifically existing in the Tomcat AJP protocol.

AJP protocol is a binary protocol that can proxy inbound requests from a web server through to an application server that sits behind the webserver.

The vulnerability can be tracked as CVE-2020-1938 and it affected all versions of Tomcat 9/8/7/6.

Affected Tomcat version:

  • Apache Tomcat 9.x < 9.0.31
  • Apache Tomcat 8.x < 8.5.51
  • Apache Tomcat 7.x < 7.0.100
  • Apache Tomcat 6.x

Ghostcat is a high-risk file read/include vulnerability in Tomcat, and it allows an attacker to execute malicious code on the target host by exploiting file inclusion flaw.

In other words, Ghostcat vulnerability allows an attacker to read the configuration files and source code files of all webapps that deployed in Tomcat, and if the web app allows a file upload due to this severe flaw, the attacker is also able to upload any files to the server.

It also lets attackers upload any malicious Java Server Pages (JSP) that enable remote code execution on the server.

According to the Researcher from Chaitin Tech, Under the following circumstances can Tomcat be exploited.

=>  If the AJP Connector is enabled and the attacker can access the 
AJP Connector service port, there is a risk of be exploited by
the Ghostcat vulnerability.
=> It should be noted that Tomcat AJP Connector is enabled by default
and listens at 0.0.0.0:8009.

Chaitin Tech reported this severe vulnerability to Apache Tomcat official on 2020/01/03 and the Apache Tomcat fixed the bug and released 9.0.31 and 8.5.51 version.

You can read the Ghostcat vulnerability patch notice from Apache for Tomcat 7.xTomcat 8.x, and Tomcat 9.x 

You can also Utilize xray vulnerability scanner from Chaitin Tech to detect Ghostcat Vulnerability.

Also Read: Most Important Web Server Penetration Testing Checklist

Follow us on TwitterLinkedinFacebook for Daily cyber security & hacking news updates.

Website

Latest articles

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...

Hackers Exploit WordPress Plugin to Steal Credit Card Data

Hackers have exploited an obscure WordPress plugin to inject malware into websites, specifically targeting...

Google Patches Chrome Zero-Day: Type Confusion in V8 JavaScript

Google has released a patch for a zero-day exploit in its Chrome browser.The...

Hackers Created Rogue VMs in Recent MITRE’s Cyber Attack

State-sponsored hackers recently exploited vulnerabilities in MITRE's Networked Experimentation, Research, and Virtualization Environment (NERVE).They...

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles