CVE-2020-1745
published 2020-04-28CVE-2020-1745: A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.84%
91.0th percentile
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | undertow | < undertow 2.0.30-1 (forky) | undertow 2.0.30-1 (forky) |
| redhat | undertow | <= 2.0.29 | — |
| redhat | undertow | >= 0 < 2.0.30-1 | 2.0.30-1 |
| undertow-io | undertow | <= 2.0.29.Final | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated inbound connections to TCP port 8009 (AJP connector default port) on Undertow servers running version 2.0.29.Final or earlier; this port is the attack vector for CVE-2020-1745. ↗
- →Detect potential RCE exploitation attempts by monitoring for JSP file uploads followed by AJP requests that trigger file inclusion — attackers upload malicious JSP code within various file types and then trigger the vulnerability. ↗
- →Alert on any external/untrusted network access to the AJP port (8009); AJP connections are treated with higher trust than HTTP by the server, making exposure to untrusted users the primary risk condition. ↗
- ·The AJP connector on port 8009 is enabled by default in vulnerable Undertow versions (≤2.0.29.Final); defenders should verify whether this port is exposed and disable or restrict it if AJP is not required. ↗
- ·Red Hat JBoss Fuse 6 camel-undertow is noted as low impact because it only supports HTTP & HTTPS and does not create an AJP listener, so AJP-based detections would not apply there. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_debian8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
undertow: AJP File Read/Inclusion Vulnerability
vendor_redhat·2020-02-26·CVSS 8.6
CVE-2020-1745 [HIGH] CWE-285 undertow: AJP File Read/Inclusion Vulnerability
undertow: AJP File Read/Inclusion Vulnerability
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before. A remote, unauthenticated attacker could exploit this vu
Red Hat
tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
vendor_redhat·2020-02-20·CVSS 9.8
CVE-2020-1938 [CRITICAL] CWE-285 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - p
Debian
CVE-2020-1745: undertow - A file inclusion vulnerability was found in the AJP connector enabled with a def...
vendor_debian·2020·CVSS 8.6
CVE-2020-1745 [HIGH] CVE-2020-1745: undertow - A file inclusion vulnerability was found in the AJP connector enabled with a def...
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
Scope: local
forky: resolved (fixed in 2.0.30-1)
sid: resolved (fixed in 2.0.30-1)
OSV
Improper Authorization in Undertoe
osv·2022-05-24
CVE-2020-1745 [HIGH] Improper Authorization in Undertoe
Improper Authorization in Undertoe
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
GHSA
Improper Authorization in Undertoe
ghsa·2022-05-24
CVE-2020-1745 [HIGH] CWE-285 Improper Authorization in Undertoe
Improper Authorization in Undertoe
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
OSV
CVE-2020-1745: A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2
osv·2020-04-28·CVSS 9.8
CVE-2020-1745 [CRITICAL] CVE-2020-1745: A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
No detection rules found.
Nuclei
PRTG Network Monitor <20.1.57.1745 - Information Disclosure
nuclei·CVSS 5.3
CVE-2020-11547 [MEDIUM] PRTG Network Monitor <20.1.57.1745 - Information Disclosure
PRTG Network Monitor Configuration Requests Sent')"
- type: word
part: body
words:
- "prtg_network_monitor"
- "Probes"
- "Groups"
condition: or
- type: status
status:
- 200
# digest: 490a0046304402207c0c65275f1f56e2aa31ed807d5039df8833b09b7a1db50a2baf965340559a4e02207188fb7c76f335e0618cc683879de6f376602a42f537edbdf2da25aa80ea0379:922c64590222798bb761d5b6d8e72950
Bugzilla
CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability [fedora-all]
bugzilla·2020-02-28·CVSS 8.6
CVE-2020-1745 [HIGH] CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability [fedora-all]
CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
Bugzilla
CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability
bugzilla·2020-02-26·CVSS 8.6
CVE-2020-1745 [HIGH] CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability
CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability
A file read/inclusion vulnerability was found in AJP connector in Undertow. This is enabled with a default AJP configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (RCE).
Discussion:
External References:
https://www.cnvd.org.cn/webinfo/show/5415
https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487
https://meterpreter.org/cve-2020-1938-apache-tomcat-a
Bugzilla
CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
bugzilla·2020-02-24·CVSS 9.8
CVE-2020-1938 [CRITICAL] CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
CVE-2020-1938 is a file read/inclusion vulnerability in the AJP connector in Apache Tomcat. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (RCE).
Discussion:
AJP is for mod_jk or mod_proxy_ajp and some other proxies, if you are not using an AJP proxy in front of your tomcat, you MUST have the AJP connector REMOVED from server.xml.
AJP is known as unencrypte
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1745https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/https://security.netapp.com/advisory/ntap-20240216-0011/https://www.cnvd.org.cn/webinfo/show/5415https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1745https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/https://security.netapp.com/advisory/ntap-20240216-0011/https://www.cnvd.org.cn/webinfo/show/5415https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487
2020-04-28
Published