Research
Apache GhostcatCVE 2020-1938
CVE-2020-1938 exploits Tomcat’s AJP connector, allowing attackers to read sensitive data and execute critical actions if file uploads are enabled.
Key Pointers:
- Understanding Tomcat connectors
- Ghostcat vulnerability was found in the Tomcat AJP connector allowing an attacker to read or include any files in Tomcat’s web app directories
- This vulnerability affects all versions of Tomcat in the default configuration which means that it has been dormant in Tomcat for more than a decade and hence needed to be updated or configured to prevent any attack
- Taking a look at how to mitigate this vulnerability
- Understanding the working of the exploit using an attack demonstration on a virtual target