0
  • Operative System: Ubuntu Server 18.04.4 LTS
  • Apache Version: 2.4.29-1ubuntu4.12
  • Apache Tomcat: 8.5.39-1ubuntu1~18.04.3
  • Apache Mod JK: 1:1.2.43-1

First of all I read many technical document from Debian/Ubuntu and Redhat, in theory if the firewall is enable and not let out the port 8009, the vulnerability is mitigated.

But as we use AJP, we prefer enable the mitigation through password too.

I test the mitigation in Windows Servers with the same version of apache, tomcat and mod_jk and works, but when I test the same config in Ubuntu Server, the comunication between apache and tomcat trought AJP not happen.

What could be my error?

The trace of error in Mod JK is this:

[Tue Mar 03 16:11:18.102 2020] [28055:139750426003200] [info] jk_open_socket::jk_connect.c (817): connect to ::1:8009 failed (errno=111)
[Tue Mar 03 16:11:18.102 2020] [28055:139750426003200] [info] ajp_connect_to_endpoint::jk_ajp_common.c (1068): (ajp13_worker) Failed opening socket to (::1:8009) (errno=111)
[Tue Mar 03 16:11:18.102 2020] [28055:139750426003200] [error] ajp_send_request::jk_ajp_common.c (1728): (ajp13_worker) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno=111)
[Tue Mar 03 16:11:18.102 2020] [28055:139750426003200] [info] ajp_service::jk_ajp_common.c (2778): (ajp13_worker) sending request to tomcat failed (recoverable), because of error during request sending (attempt=1)
[Tue Mar 03 16:11:18.202 2020] [28055:139750426003200] [info] jk_open_socket::jk_connect.c (817): connect to ::1:8009 failed (errno=111)
[Tue Mar 03 16:11:18.202 2020] [28055:139750426003200] [info] ajp_connect_to_endpoint::jk_ajp_common.c (1068): (ajp13_worker) Failed opening socket to (::1:8009) (errno=111)
[Tue Mar 03 16:11:18.202 2020] [28055:139750426003200] [error] ajp_send_request::jk_ajp_common.c (1728): (ajp13_worker) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno=111)
[Tue Mar 03 16:11:18.202 2020] [28055:139750426003200] [info] ajp_service::jk_ajp_common.c (2778): (ajp13_worker) sending request to tomcat failed (recoverable), because of error during request sending (attempt=2)
[Tue Mar 03 16:11:18.202 2020] [28055:139750426003200] [error] ajp_service::jk_ajp_common.c (2799): (ajp13_worker) connecting to tomcat failed (rc=-3, errors=3, client_errors=0).
[Tue Mar 03 16:11:18.203 2020] [28055:139750426003200] [info] jk_handler::mod_jk.c (2995): Service error=-3 for worker=ajp13_worker

Document for mitigation: https://access.redhat.com/solutions/4851251

Resume of task:

Modify server.xml

<Connector port="8009" 
        protocol="AJP/1.3" 
        redirectPort="8443"
        requiredSecret="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" />

Workers.properties

workers.tomcat_home=/usr/share/tomcat8

workers.java_home=/usr/lib/jvm/default-java


ps=/


worker.list=ajp13_worker


worker.ajp13_worker.port=8009
worker.ajp13_worker.host=localhost
worker.ajp13_worker.type=ajp13
#worker.ajp13_worker.secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx


worker.ajp13_worker.lbfactor=1


worker.loadbalancer.type=lb
worker.loadbalancer.balance_workers=ajp13_worker
#worker.loadbalancer.secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx


configure jk-status


#worker.list=jk-status
#worker.jk-status.type=status
#worker.jk-status.read_only=true


configure jk-manager


#worker.list=jk-manager
#worker.jk-manager.type=status

I thank you for any help you can give me on the subject.

Lorenz Keel
  • 8,905
Andrés González Tenorio
  • 11

1 Answers1

0

CVE-2020-1938 aka Ghostcat

Desciption: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

National Vulnerability Database CVE-2020-1938

RedHat Announce CVE-2020-1938

Andrés González Tenorio
  • 11