CVE-2020-1938
Published: 24 February 2020
Summary
CVE-2020-1938 is a critical-severity an unspecified weakness vulnerability in Blackberry Workspaces Server. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SC-7 (Boundary Protection).
Deeper analysis
Apache Tomcat versions 9.0.0.M1 through 9.0.0.30, 8.5.0 through 8.5.50, and 7.0.0 through 7.0.99 contain a vulnerability in the default configuration of the Apache JServ Protocol (AJP) Connector. The connector is enabled by default and binds to all configured IP addresses, treating AJP traffic as inherently more trusted than equivalent HTTP connections. This permits an attacker who can reach the AJP port to retrieve arbitrary files from within a web application or to force Tomcat to interpret any file in the application as a JSP page.
An attacker with network access to the AJP endpoint can therefore read sensitive application content or achieve remote code execution when the target application permits file uploads that are stored inside the web root. The CVSS 3.1 base score is 9.8, reflecting the combination of network accessibility, lack of required authentication, and full confidentiality, integrity, and availability impact.
Apache Tomcat 9.0.31, 8.5.51, and 7.0.100 introduced hardening changes to the default AJP Connector configuration. The project states that mitigation is required only when an AJP port is reachable by untrusted parties; otherwise, administrators may simply disable the connector. Several vendor advisories, including those from the Apache project and downstream distributions, recommend upgrading or explicitly restricting AJP listener addresses and enabling the secret attribute for authentication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-0481
Vulnerability details
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an…
more
attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
- CWE(s)
- KEV Date Added
- 03 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Blocks untrusted network access to the AJP connector port that listens on all interfaces by default.
Requires disabling the AJP connector or restricting its functionality when not needed, directly addressing the insecure default configuration.
Enforces authentication of the AJP service connection via the secret attribute to prevent unauthenticated trusted-channel abuse.