When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat
Why It Matters
Analysis dossierWhy It Matters
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
Immediate Attention
Yes
Unknown
Risk basis: CISA KEV exploitation signal; SOC ecosystem technology relevance; CRITICAL severity; Source-confirmed exploitation or CISA KEV/ransomware metadata
Affected Products & Remediation
21 source-backed products- apache geode · 1.12.0 · NVD CPE · Source
- apache tomcat · >= 7.0.0 < 7.0.100; >= 8.5.0 < 8.5.51; >= 9.0.0 < 9.0.31 · NVD CPE · Source
- fedoraproject fedora · 30; 31; 32 · NVD CPE · Source
- oracle agile engineering data management · 6.2.1.0 · NVD CPE · Source
- oracle agile product lifecycle management · 9.3.3; 9.3.5; 9.3.6 · NVD CPE · Source
- oracle communications element manager · 8.1.1; 8.2.0; 8.2.1 · NVD CPE · Source
- oracle communications instant messaging server · 10.0.1.4.0 · NVD CPE · Source
- oracle health sciences empirica inspections · 1.0.1.2 · NVD CPE · Source
- oracle health sciences empirica signal · 7.3.3 · NVD CPE · Source
- oracle hospitality guest access · 4.2.0; 4.2.1 · NVD CPE · Source
- oracle instantis enterprisetrack · >= 17.1 <= 17.3 · NVD CPE · Source
- oracle mysql enterprise monitor · <= 4.0.12; >= 8.0.0 <= 8.0.20 · NVD CPE · Source
- oracle siebel ui framework · <= 20.5 · NVD CPE · Source
- oracle transportation management · 6.3.7 · NVD CPE · Source
- oracle workload manager · 12.2.0.1; 18c; 19c · NVD CPE · Source
- debian debian linux · 8.0; 9.0; 10.0 · NVD CPE · Source
- opensuse leap · 15.1 · NVD CPE · Source
- blackberry good control · <= 5.2.58.38 · NVD CPE · Source
- blackberry workspaces server · 7.0.1; 7.1.2; 8.1.0; 9.0 · NVD CPE · Source
- netapp data availability services · version range not provided by source · NVD CPE · Source
- netapp oncommand system manager · >= 3.0.0 <= 3.1.3 · NVD CPE · Source
Vendor or catalog guidance (source)
- CISA KEV: Apply updates per vendor instructions.
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Listed
- Exploited (source statement)
- Yes
- Publicly disclosed (source)
- Unknown
CISA required action: Apply updates per vendor instructions.
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched kev-network-exposure (CVSS AV:N, CISA KEV Listed); network-unauthenticated (CVSS AV:N, CVSS PR:N, CVSS UI:N)
Exposure
- Identify assets with the exact CVE and confirm the affected product/version against the advisory.Telemetry: DeviceTvmSoftwareVulnerabilities · KEV listing raises urgency, but inventory is needed to establish local exposure. · Rule kev-network-exposure
- Identify devices reporting this CVE and note which expose the affected service to untrusted networks.Telemetry: DeviceTvmSoftwareVulnerabilities · A network-reachable, no-privilege vector makes internet-facing instances the first exposure question. · Rule network-unauthenticated
Exploitation evidence
- Review relevant edge or application access logs for unusual requests around the advisory window.Telemetry: CommonSecurityLog · Log review is a hunting hypothesis; KEV listing alone does not show local exploitation. · Rule kev-network-exposure
Show more (2)
Exploitation evidence
- Review inbound connections to the affected service from unexpected sources since the advisory date.Telemetry: DeviceNetworkEvents · Hunting hypothesis from the CVSS vector; it does not show that exploitation occurred. · Rule network-unauthenticated
Response
- Recheck the affected assets after the source-stated mitigation or update is applied.Telemetry: DeviceTvmSoftwareVulnerabilities · A follow-up inventory check verifies local remediation. · Rule kev-network-exposure
CISA KEV Record
Apply updates per vendor instructions.
Change History & Source Data
— No recorded material change
- CNA / source
- security@apache.org
- Record status · verification
- UPDATED · CISA KEV confirmed
- CPE
- cpe:2.3:a:apache:geode:1.12.0:*:*:*:*:*:*:*, cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*, cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*, cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*, cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*, cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*, cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2020-1938"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descLooking up related community queries…