CVE-2020-1938: Arbitrary File Read vulnerability in org.apache.tomcat.embed:tomcat-embed-core

What is CVE-2020-1938 About?

Apache Tomcat versions 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99 are vulnerable when an AJP port is accessible to untrusted users. This flaw allows attackers to return arbitrary files from the web application or process any file as a JSP, potentially leading to remote code execution. Exploitation requires direct access to the AJP connector, but if accessible, it is highly impactful.

Affected Software

org.apache.tomcat.embed:tomcat-embed-core
- >9.0.0, <9.0.31
- >8.0.0, <8.5.51
- >7.0.0, <7.0.100

Technical Details

The vulnerability stems from the default configuration of the AJP Connector in affected Apache Tomcat versions, which listened on all configured IP addresses and treated AJP connections with high trust. An attacker with access to the AJP port could leverage this trust model to manipulate requests. Specifically, they could craft AJP messages to request arbitrary files from the web application's directory structure, circumventing standard web server access controls. Furthermore, the mechanism allowed for processing any file within the web application as a JSP, even if it wasn't intended to be. If an attacker could also upload files (e.g., via a legitimate file upload feature), or control web application content, they could upload a malicious JSP or other executable file and then use this AJP vulnerability to trigger its execution, leading to Remote Code Execution.

What is the Impact of CVE-2020-1938?

Successful exploitation may allow attackers to read sensitive files, execute arbitrary code on the server, or gain control over the affected system.

What is the Exploitability of CVE-2020-1938?

Exploitation of this vulnerability is relatively complex, requiring direct network access to the AJP Connector port. There are no authentication requirements to access the AJP connector itself if it's publicly exposed, and no specific user privileges are needed on the Tomcat server post-exploitation of the AJP protocol. This is a remote exploit. A key constraint is that the AJP port must be accessible to untrusted users. The likelihood of exploitation is significantly increased if the AJP Connector is exposed directly to the internet or an untrusted internal network, contrary to best practices. If file upload functionality is available in the web application or the attacker can control web content, the arbitrary file processing capability can be escalated to remote code execution, making the exploit highly critical.

What are the Known Public Exploits?

PoC Author	Link	Commentary
00theway	Link	Ghostcat read file/code execute,CNVD-2020-10487(CVE-2020-1938)
bkfish	Link	Cnvd-2020-10487 / cve-2020-1938, scanner tool
lizhianyuguangming	Link	tomcat自动化漏洞扫描利用工具，支持批量弱口令检测、后台部署war包getshell、CVE-2017-12615 文件上传、CVE-2020-1938/CNVD-2020-10487 文件包含

What are the Available Fixes for CVE-2020-1938?

Available Upgrade Options

org.apache.tomcat.embed:tomcat-embed-core
- >7.0.0, <7.0.100 → Upgrade to 7.0.100
org.apache.tomcat.embed:tomcat-embed-core
- >8.0.0, <8.5.51 → Upgrade to 8.5.51
org.apache.tomcat.embed:tomcat-embed-core
- >9.0.0, <9.0.31 → Upgrade to 9.0.31

Struggling with dependency upgrades?

See how Resolved Security's drop-in replacements make it simple.

Book a demo

Additional Resources

What are Similar Vulnerabilities to CVE-2020-1938?

Similar Vulnerabilities: CVE-2020-1935 , CVE-2014-0096 , CVE-2007-0453 , CVE-2007-0452 , CVE-2007-0451

CVE-2020-1938 Arbitrary File Read vulnerability in org.apache.tomcat.embed:tomcat-embed-core