# Apache Tomcat AJP protocol vulnerability allows unauthorized file read and potential…

Published: 2020-02-24 · Severity: high
Canonical: https://vorant.io/reports/bd27c64c-759c-437c-8829-05cf874b70e3/apache-tomcat-ajp-protocol-vulnerability-allows-unauthorized-file-read-and

> Apache Tomcat AJP protocol vulnerability allows unauthorized file read and potential remote code execution via malicious requests.

IPA Japan disclosed a vulnerability in Apache Tomcat's AJP (Apache JServ Protocol) implementation that permits unauthorized file access. Attackers can send crafted AJP requests to read arbitrary files from the web application's root directory. In environments where web applications allow file uploads or storage, this vulnerability escalates to remote code execution, as attackers could upload malicious code and then read/execute it via the AJP vulnerability.

Public exploit code has already been released, increasing the risk of widespread exploitation. The advisory emphasizes immediate patching due to active exploitation concerns. This affects multiple versions of Apache Tomcat, and administrators should consult vendor documentation for specific version remediation guidance.

The vulnerability represents a significant risk to organizations running Apache Tomcat with AJP protocol enabled, particularly those with file upload functionality. The combination of arbitrary file read with potential code execution capabilities makes this a critical security issue requiring urgent attention.

## Mentioned in this report

- Vulnerabilities: CVE-2020-1938 (KEV)

## Detection guidance (public sample)

### Apache Tomcat AJP Connector Traffic from External Host (Potential Ghostcat Exploitation)

ATT&CK: T1190

Detects inbound network connections to the Tomcat AJP port (8009) from non-loopback/non-management sources, which may indicate exploitation attempts of the Ghostcat AJP file-read vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Tomcat AJP Port Connection From External Source
id: 7695c4ff-bc46-5c5e-aac7-c230bcb2c722
status: experimental
description: Detects network connections to TCP port 8009 (Apache JServ Protocol)
  which, when reachable from untrusted or external networks, may indicate exploitation
  attempts of the Tomcat AJP arbitrary file read vulnerability (Ghostcat).
references:
- https://www.ipa.go.jp
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 8009
  filter_local:
    SourceIp|startswith:
    - '127.'
    - '10.'
    - 172.16.
    - 192.168.
  condition: selection and not filter_local
falsepositives:
- Legitimate internal load balancer or reverse proxy communication with Tomcat over
  AJP
- Internal monitoring tools scanning AJP port for health checks
level: medium
tags:
- attack.t1190
- attack.initial_access
author: Vorant
```

### Tomcat Java Process Spawning Shell After Possible AJP Exploitation

ATT&CK: T1203

Detects a Java/Tomcat process (catalina) spawning a command shell or scripting interpreter, which is anomalous and may indicate remote code execution following exploitation of the AJP file-read/write vulnerability to plant and execute a malicious JSP or script. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by Tomcat Java Process
id: 83e5f52c-4c72-5833-a601-2157f2824373
status: experimental
description: Detects cmd.exe, powershell.exe, or sh/bash spawned as a child of a Java
  process running Tomcat (catalina), which is unusual and may indicate post-exploitation
  code execution after abusing the AJP file read/write vulnerability to upload and
  trigger a malicious JSP.
references:
- https://www.ipa.go.jp
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: java
    ParentCommandLine|contains:
    - catalina
    - tomcat
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \sh
    - \bash
  condition: selection
falsepositives:
- Administrative scripts or health-check tasks launched from Tomcat management scripts
- Custom application deployment automation that shells out from within the JVM
level: high
tags:
- attack.t1203
- attack.execution
author: Vorant
```

### Suspicious JSP File Write in Tomcat Webapps Directory

ATT&CK: T1005

Detects creation or modification of JSP files within a Tomcat webapps/WEB-INF directory shortly after AJP traffic, which may indicate a webshell or malicious payload was uploaded and is being staged for read/execution via the AJP file-read vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: New JSP File Created in Tomcat Webapps Directory
id: a1f316a6-4547-5f4a-91a5-48d253bf06b4
status: experimental
description: Detects creation of new .jsp files inside Tomcat webapps or WEB-INF directories,
  which can indicate a webshell being planted to be later read or executed via the
  AJP arbitrary file read/write vulnerability (Ghostcat).
references:
- https://www.ipa.go.jp
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \webapps\
    - \WEB-INF\
    TargetFilename|endswith: .jsp
  filter_known:
    TargetFilename|contains:
    - \webapps\ROOT\index.jsp
    - \webapps\manager\
  condition: selection and not filter_known
falsepositives:
- Legitimate application deployment or update pushing new JSP pages
- Developer or CI/CD pipeline deploying updated web application code
level: medium
tags:
- attack.t1005
- attack.collection
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20200225.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bd27c64c-759c-437c-8829-05cf874b70e3/apache-tomcat-ajp-protocol-vulnerability-allows-unauthorized-file-read-and.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup