Path traversal in Apache Tomcat - CVE-2020-1938

Vulnerability identifier: #VU25502

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-1938

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Apache Tomcat AJP connector. A remote attacker can send a specially crafted AJP request, include and execute arbitrary files on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Apache Tomcat
Cloud Foundry UAA
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux for Scientific Computing
CentOS
Fedora
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Oracle Solaris
Opensuse
Oracle Health Sciences Empirica Inspections
Oracle Communications Instant Messaging Server
EMC Atmos
Dell Support Assist Enterprise
IBM Engineering Requirements Management DOORS Next
Dell Wyse Management Repository
Dell Wyse Management Suite
EMC Integrated Data Protection Appliance
MySQL Enterprise Monitor
Oracle Hospitality Guest Access
Oracle Communications Element Manager
Dell Secure Connect Gateway
Oracle Health Sciences Empirica Signal
tomcat6 (Red Hat package)
tomcat (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
tomcat8 (Debian package)
tomcat9 (Debian package)
tomcat
Oracle Agile PLM Framework
Zoho ManageEngine Desktop Central
CF Deployment
Huawei SMSGW

Install update from vendor's website.

Apache Tomcat - addressed in versions 7.0.100, 8.5.51, 9.0.31
MySQL Enterprise Monitor - update to 8.0.21
Dell Support Assist Enterprise - update to 4.00.06.00
Dell Secure Connect Gateway - update to 5.12.00.10
tomcat6 (Red Hat package) - update to 6.0.24-114.el6_10
tomcat (Red Hat package) - addressed in versions 7.0.76-10.el7_6, 7.0.76-11.el7_7
tomcat8 (Debian package) - update to 8.5.54-0+deb9u1
tomcat9 (Debian package) - update to 9.0.31-1~deb10u1
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
Zoho ManageEngine Desktop Central - addressed in versions 10.0.478, 10.0.512
CF Deployment - update to 12.40.0
Cloud Foundry UAA - update to 74.16.0
Huawei SMSGW - update to V100R003C01LG6301SPC009
Dell Wyse Management Repository - update to 2.0
Dell Wyse Management Suite - update to 2.0
tomcat - addressed in versions 7.0.100-2.el6, 9.0.31-2.fc30, 9.0.31-2.fc31, 9.0.31-2.fc32

• Exploit #8863 - AttackTomcat (Tomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tomcat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 Tomcat AJP文件读取/包含) (February 22, 2023)
• Exploit #8277 - CVE-2020-1938 (This is a modified version of the original GhostCat Exploit) (August 21, 2022)
• Exploit #6625 - ghostcat (An implementation of CVE-2020-1938) (August 15, 2021)
• Exploit #6554 - CVE_2020_1938 () (July 25, 2021)
• Exploit #6534 - CVE-2020-1938 (Scanner for CVE-2020-1938) (July 12, 2021)
• Exploit #5321 - CVE-2020-1938 () (April 28, 2021)
• Exploit #5262 - CVE-2020-1938-Tool (批量检测幽灵猫漏洞) (April 1, 2021)
• Exploit #5250 - Hacking-Vulnerability-CVE-2020-1938-Ghostcat () (March 30, 2021)
• Exploit #5104 - CVE-2020-1938-MSF-MODULE (Modified version of auxiliary/admin/http/tomcat_ghostcat, it can Read any file) (February 1, 2021)
• Exploit #4898 - Ghostcat (December 3, 2020)
• Exploit #3536 - ghostcatch (Disables AJP connectors to remediate CVE-2020-1938!) (July 20, 2020)
• Exploit #3535 - Path traversal (July 20, 2020)
• Exploit #3455 - CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner (Cnvd-2020-10487 / cve-2020-1938, scanner tool) (July 15, 2020)
• Exploit #3014 - CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner (Cnvd-2020-10487 / cve-2020-1938, scanner tool) (June 3, 2020)
• Exploit #3013 - GhostCat-LFI-exp (CVE-2020-1938) (June 3, 2020)
• Exploit #2969 - CVE-2020-1938 (This is about CVE-2020-1938) (June 3, 2020)
• Exploit #2887 - CVE-2020-1938-Tool (批量检测幽灵猫漏洞) (June 3, 2020)
• Exploit #2897 - CNVD-2020-10487 (CVE-2020-1938 / CNVD-2020-1048 Detection Tools) (June 3, 2020)
• Exploit #2858 - CVE-2020-1938TomcatAjpScanner (批量扫描TomcatAJP漏洞) (June 3, 2020)
• Exploit #2855 - CVE-2020-1938-Tomact-file_include-file_read (Tomcat的文件包含及文件读取漏洞利用POC) (June 3, 2020)
• Exploit #2854 - CVE-2020-1938 (在一定条件下可执行命令) (June 3, 2020)
• Exploit #2853 - CVE-2020-1938 () (June 3, 2020)
• Exploit #2852 - CVE-2020-1938 (CVE-2020-1938漏洞复现) (June 3, 2020)
• Exploit #2658 - Ghostcat (CVE-2020-1938 exploit) (May 12, 2020)
• Exploit #2308 - exphub (Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340) (April 7, 2020)
• Exploit #2219 - CVE-2020-1938 () (March 18, 2020)
• Exploit #323 - CNVD-2020-10487-Bulk-verification (CNVD-2020-10487 OR CVE-2020-1938 批量验证脚本，批量验证，并自动截图，方便提交及复核) (March 18, 2020)
• Exploit #322 - CNVD-2020-10487-Tomcat-ajp-POC (CNVD-2020-10487(CVE-2020-1938), tomcat ajp 文件读取漏洞poc) (March 18, 2020)
• Exploit #324 - CVE-2020-1938 (CVE-2020-1938) (March 18, 2020)
• Exploit #325 - tomcat-cve-2020-1938-check () (March 18, 2020)
• Exploit #326 - Ghostcat-CNVD-2020-10487 (Ghostcat read file/code execute,CNVD-2020-10487(CVE-2020-1938) ) (March 18, 2020)
• Exploit #327 - CVE_2020_1938_ajp_poc (CVE_2020_1938_ajp_poc) (March 18, 2020)
• Exploit #328 - ghostcat-verification (Learnings on how to verify if vulnerable to Ghostcat (aka CVE-2020-1938)) (March 18, 2020)
• Exploit #329 - Ghostcat-CVE-2020-1938 (Test Explo for Ghostcat CVE-2020-1938) (March 18, 2020)
• Exploit #330 - CVE-2020-1938 () (March 18, 2020)
• Exploit #331 - CVE-2020-1938-Clean-Version (CVE-2020-1938(GhostCat) clean and readable code version) (March 18, 2020)

• https://www.jdcloud.com/cn/notice/detail/839/type/5
• https://www.youtube.com/watch?v=4g1AWHLLuL8
• https://github.com/Kit4y/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner

• Multiple vulnerabilities in Apache Tomcat
• Amazon Linux AMI update for tomcat8
• Amazon Linux AMI update for tomcat7
• OpenSUSE Linux update for tomcat
• Gentoo update for Apache Tomcat
• Red Hat Enterprise Linux 6 update for tomcat6
• CentOS 6 update for tomcat6
• CentOS 7 update for tomcat
• Cloud Foundry UAA update for Apache Tomcat
• Oracle Solaris update for third party packages
• OpenSUSE Linux update for apache2
• Debian update for tomcat8
• Debian update for tomcat9
• Zoho ManageEngine Desktop Central update for Apache Tomcat
• Red Hat Enterprise Linux 7 update for tomcat
• Multiple vulnerabilities in Oracle Communications Instant Messaging Server
• Multiple vulnerabilities in Oracle Communications Element Manager
• Path traversal in Oracle Hospitality Guest Access
• Path traversal in Oracle Health Sciences Empirica Signal
• Path traversal in Oracle Health Sciences Empirica Inspections
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Path traversal in Huawei SMSGW
• Multiple vulnerabilities in Oracle Agile PLM Framework
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Path traversal in Dell EMC Atmos Cloud Delivery Platform
• Path traversal in Dell EMC Integrated Data Protection Appliance
• Path traversal in Dell Wyse Management Suite and Dell Wyse Management Repository
• Red Hat Enterprise Linux 7 update for tomcat
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Fedora EPEL 6 update for tomcat
• Fedora 30 update for tomcat
• Fedora 32 update for tomcat
• Fedora 31 update for tomcat