Apache Tomcat AJP protocol enables unauthorized file read and RCE
Apache Tomcat AJP protocol vulnerability allows unauthorized file read and potential remote code execution via malicious requests.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2020-1938 as exploited in the wild.
IPA Japan disclosed a vulnerability in Apache Tomcat's AJP (Apache JServ Protocol) implementation that permits unauthorized file access. Attackers can send crafted AJP requests to read arbitrary files from the web application's root directory. In environments where web applications allow file uploads or storage, this vulnerability escalates to remote code execution, as attackers could upload malicious code and then read/execute it via the AJP vulnerability.
Public exploit code has already been released, increasing the risk of widespread exploitation. The advisory emphasizes immediate patching due to active exploitation concerns. This affects multiple versions of Apache Tomcat, and administrators should consult vendor documentation for specific version remediation guidance.
The vulnerability represents a significant risk to organizations running Apache Tomcat with AJP protocol enabled, particularly those with file upload functionality. The combination of arbitrary file read with potential code execution capabilities makes this a critical security issue requiring urgent attention.
Mentioned in this report
Detection guidance
Apache Tomcat AJP Connector Traffic from External Host (Potential Ghostcat Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects inbound network connections to the Tomcat AJP port (8009) from non-loopback/non-management sources, which may indicate exploitation attempts of the Ghostcat AJP file-read vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Tomcat AJP Port Connection From External Source
id: 7695c4ff-bc46-5c5e-aac7-c230bcb2c722
status: experimental
description: Detects network connections to TCP port 8009 (Apache JServ Protocol)
which, when reachable from untrusted or external networks, may indicate exploitation
attempts of the Tomcat AJP arbitrary file read vulnerability (Ghostcat).
references:
- https://www.ipa.go.jp
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 8009
filter_local:
SourceIp|startswith:
- '127.'
- '10.'
- 172.16.
- 192.168.
condition: selection and not filter_local
falsepositives:
- Legitimate internal load balancer or reverse proxy communication with Tomcat over
AJP
- Internal monitoring tools scanning AJP port for health checks
level: medium
tags:
- attack.t1190
- attack.initial-access
author: Vorant
Tomcat Java Process Spawning Shell After Possible AJP Exploitation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Java/Tomcat process (catalina) spawning a command shell or scripting interpreter, which is anomalous and may indicate remote code execution following exploitation of the AJP file-read/write vulnerability to plant and execute a malicious JSP or script. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Tomcat Java Process
id: 83e5f52c-4c72-5833-a601-2157f2824373
status: experimental
description: Detects cmd.exe, powershell.exe, or sh/bash spawned as a child of a Java
process running Tomcat (catalina), which is unusual and may indicate post-exploitation
code execution after abusing the AJP file read/write vulnerability to upload and
trigger a malicious JSP.
references:
- https://www.ipa.go.jp
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: java
ParentCommandLine|contains:
- catalina
- tomcat
Image|endswith:
- \cmd.exe
- \powershell.exe
- \sh
- \bash
condition: selection
falsepositives:
- Administrative scripts or health-check tasks launched from Tomcat management scripts
- Custom application deployment automation that shells out from within the JVM
level: high
tags:
- attack.t1203
- attack.execution
author: Vorant
Suspicious JSP File Write in Tomcat Webapps Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation or modification of JSP files within a Tomcat webapps/WEB-INF directory shortly after AJP traffic, which may indicate a webshell or malicious payload was uploaded and is being staged for read/execution via the AJP file-read vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New JSP File Created in Tomcat Webapps Directory
id: a1f316a6-4547-5f4a-91a5-48d253bf06b4
status: experimental
description: Detects creation of new .jsp files inside Tomcat webapps or WEB-INF directories,
which can indicate a webshell being planted to be later read or executed via the
AJP arbitrary file read/write vulnerability (Ghostcat).
references:
- https://www.ipa.go.jp
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \webapps\
- \WEB-INF\
TargetFilename|endswith: .jsp
filter_known:
TargetFilename|contains:
- \webapps\ROOT\index.jsp
- \webapps\manager\
condition: selection and not filter_known
falsepositives:
- Legitimate application deployment or update pushing new JSP pages
- Developer or CI/CD pipeline deploying updated web application code
level: medium
tags:
- attack.t1005
- attack.collection
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20200225.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs