严重 Apache Tomcat AJP 文件读取与包含漏洞

CVE编号

CVE-2020-1938

利用情况

EXP 已公开

补丁情况

官方补丁

披露时间

2020-02-25
该漏洞EXP已公开传播,漏洞利用成本极低,建议您立即关注并修复。
漏洞描述
Apache Tomcat是由Apache软件基金会属下Jakarta项目开发的Servlet容器。默认情况下,Apache Tomcat会开启AJP连接器,方便与其他Web服务器通过AJP协议进行交互。但Apache Tomcat在AJP协议的实现上存在漏洞,导致攻击者可以通过发送恶意的AJP请求,可以读取或者包含Web应用根目录下的任意文件,如果存在文件上传功能,将可以导致任意代码执行。漏洞利用AJP服务端口实现攻击,未开启AJP服务对外不受漏洞影响(tomcat默认将AJP服务开启并绑定至0.0.0.0)。阿里云应急响应中心提醒 Apache Tomcat用户尽快排查AJP端口对外情况并采取安全措施阻止漏洞攻击。

影响版本

Apache Tomcat 6

Apache Tomcat 7 < 7.0.100

Apache Tomcat 8 < 8.5.51

Apache Tomcat 9 < 9.0.31

安全版本

Apache Tomcat 7.0.100

Apache Tomcat 8.5.51

Apache Tomcat 9.0.31
解决建议
1、升级至安全版本;

2、关闭AJP连接器,修改Tomcat的service.xml,注释掉 。或者禁止Tomcat 的 AJP端口对公网开放;

3、针对阿里云用户,可使用安全组临时禁止AJP服务端口(常见为8009端口)对外,阻止漏洞攻击。
参考链接
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
http://support.blackberry.com/kb/articleDetail?articleNumber=000062739
https://help.aliyun.com/noticelist/articleid/1060232750.html
https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a...
https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd...
https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c...
https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c...
https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c0...
https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e...
https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a6...
https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54...
https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c2...
https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f...
https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be2...
https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c1...
https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e09...
https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d...
https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63...
https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398...
https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a9...
https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63ad...
https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c...
https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86b...
https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603...
https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f...
https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f...
https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea56924355...
https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a9...
https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf...
https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a...
https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5...
https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a...
https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0...
https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e8117...
https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68...
https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6ef...
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52...
https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a...
https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d...
https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html
https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...
https://security.gentoo.org/glsa/202003-43
https://security.netapp.com/advisory/ntap-20200226-0002/
https://www.debian.org/security/2020/dsa-4673
https://www.debian.org/security/2020/dsa-4680
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 apache tomcat * From
(including)
7.0.0
Up to
(including)
7.0.99
运行在以下环境
应用 apache tomcat * From
(including)
8.5.0
Up to
(including)
8.5.50
运行在以下环境
应用 apache tomcat * From
(including)
9.0.0
Up to
(including)
9.0.30
运行在以下环境
系统 alibaba_cloud_linux_2.1903 tomcat * Up to
(excluding)
7.0.76-11.1.al7
运行在以下环境
系统 amazon linux_2 tomcat * Up to
(excluding)
2.2-api-7.0.76-10.amzn2.0.1
运行在以下环境
系统 amazon linux_AMI tomcat * Up to
(excluding)
3.0-api-7.0.100-1.36.amzn1
运行在以下环境
系统 amazon_2 tomcat * Up to
(excluding)
7.0.76-10.amzn2.0.1
运行在以下环境
系统 amazon_AMI tomcat * Up to
(excluding)
3.0-api-7.0.100-1.36.amzn1
运行在以下环境
系统 centos_6 tomcat * Up to
(excluding)
6.0.24-114.el6_10
运行在以下环境
系统 centos_7 tomcat * Up to
(excluding)
7.0.76-11.el7_7
运行在以下环境
系统 debian_10 tomcat * Up to
(excluding)
9.0.31-1~deb10u1
运行在以下环境
系统 debian_8 tomcat * Up to
(excluding)
7.0.56-3+deb8u3
运行在以下环境
系统 debian_9 tomcat * Up to
(including)
7.0.75-1
运行在以下环境
系统 fedora_30 tomcat * Up to
(excluding)
9.0.31-2.fc30
运行在以下环境
系统 fedora_31 tomcat * Up to
(excluding)
9.0.31-2.fc31
运行在以下环境
系统 fedora_32 tomcat * Up to
(excluding)
9.0.31-2.fc32
运行在以下环境
系统 fedora_EPEL_6 tomcat * Up to
(excluding)
7.0.100-2.el6
运行在以下环境
系统 opensuse_Leap_15.1 tomcat * Up to
(excluding)
2.4.33-lp151.8.12.1
运行在以下环境
系统 oracle linux_6 tomcat * Up to
(excluding)
6.0.24-114.el6_10
运行在以下环境
系统 oracle linux_7 tomcat * Up to
(excluding)
7.0.76-11.el7_7
运行在以下环境
系统 oracle_6 tomcat * Up to
(excluding)
6.0.24-114.el6_10
运行在以下环境
系统 oracle_7 tomcat * Up to
(excluding)
7.0.76-11.el7_7
运行在以下环境
系统 redhat_6 tomcat6 * Up to
(excluding)
0:6.0.24-114.el6_10
运行在以下环境
系统 redhat_7 tomcat * Up to
(excluding)
0:7.0.76-11.el7_7
运行在以下环境
系统 sles_12 apache2 * Up to
(excluding)
2.4.16-20.29
运行在以下环境
系统 sles_12_SP4 tomcat * Up to
(excluding)
2.4.23-29.54.1
运行在以下环境
系统 sles_12_SP5 tomcat * Up to
(excluding)
2.4.23-29.54.1
运行在以下环境
系统 suse_12 apache2 * Up to
(excluding)
2.4.16-20.29
运行在以下环境
系统 suse_12_SP4 tomcat * Up to
(excluding)
2.4.23-29.54.1
运行在以下环境
系统 suse_12_SP5 tomcat * Up to
(excluding)
2.4.23-29.54.1
运行在以下环境
系统 unionos_20 tomcat * Up to
(excluding)
9.0.31-1~deb10u2
阿里云评分
9.4
  • 攻击路径
    远程
  • 攻击复杂度
    容易
  • 权限要求
    无需权限
  • 影响范围
    全局影响
  • EXP成熟度
    EXP 已公开
  • 补丁情况
    官方补丁
  • 数据保密性
    数据泄露
  • 数据完整性
    传输被破坏
  • 服务器危害
    服务器失陷
  • 全网数量
    N/A
CWE-ID 漏洞类型
CWE-20 输入验证不恰当
CWE-269 特权管理不恰当
阿里云安全产品覆盖情况