CVE-2020-1938

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 9.0.0.M1 through 9.0.0.30 Apache Tomcat versions 8.5.0 through 8.5.50 Apache Tomcat versions 7.0.0 through 7.0.99

Description Apache Tomcat treats connections using the Apache JServ Protocol (AJP) with a higher level of trust than HTTP connections. The AJP Connector was enabled by default and listened on all configured IP addresses, which can be exploited if the AJP port is accessible to untrusted users. This issue allows an attacker to return arbitrary files from anywhere within the web application, including the WEB-INF and META-INF directories, or any location reachable via ServletContext.getResourceAsStream(). Additionally, it allows processing any file within the web application as a JSP. If the application permits file uploads or if an attacker can otherwise control the application content, this capability can lead to remote code execution. Other risks include bypassing security checks based on client IP addresses and bypassing user authentication if Tomcat is configured to trust authentication data from a reverse proxy.

Recommendations Update Apache Tomcat versions 9.0.0.M1 through 9.0.0.30 to version 9.0.31 or later. Update Apache Tomcat versions 8.5.0 through 8.5.50 to version 8.5.51 or later. Update Apache Tomcat versions 7.0.0 through 7.0.99 to version 7.0.100 or later. Disable the AJP Connector if it is not required. Restrict access to the AJP port to prevent untrusted users from connecting.