The security breach is A serious vulnerability in Tomcat has been discovered and confirmed.
Due to a flaw in the Apache JServ Protocol (AJP) . This breach allows an intruder, to read files and code in the webapps folderit’s possible for an attacker to read and even modify directories and files within the Tomcat directory-structure. In some cases, the breach allows to upload the vulnerability even allowed the upload of executable code.
Caution: KGS products don’t use the AJP.
Affected Versions
Apache Tomcat version 6.x (all versions) |
Apache Tomcat version 7.x (before version 7.0.100) |
Apache Tomcat version 8.x (before version 8.5.51) |
Apache Tomcat version 9.x (before version 9.0.31) |
...
How can I fix it?
You can fix the breach vulnerability by installing the versions / updating your Apache Tomcat installation to version 7.0.100 , 8.5.51 or 9.0.31.
If you do not use other web application that use the AJP
...
you may disable it as stated here:
Step 1:
Find the file server.xml in CATALINA_Base/conf and edit the line:
...
In addition to the above measures, of course, you can also use firewalls to prevent untrusted sources from accessing the Tomcat AJP Connector service port.
If you use web applications that use the AJP
...
:
Step 1:
Upgrade to the versions 9.0.31, 8.5.51, or 7.0.100.
...
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="YOUR_TOMCAT_IP_ADDRESS" secret="YOUR_TOMCAT_AJP_SECRET" />
Alternative (without Upgrading):
Step 1:
Configure the attribute “requiredSecret“:
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="YOUR_TOMCAT_IP_ADDRESS" requiredSecret="YOUR_TOMCAT_AJP_SECRET" />
Caution: You need to change the placeholder The “YOUR_TOMCAT_AJP_SECRET” to an safer value, that cannot be easly cracked or guessedis a placeholder which shall be replaced by a strong secret.