Apache Tomcat AJP “Ghostcat” (CVE‑2020‑1938) – Improper Privilege Management Allows File Read
What It Is – The “Ghostcat” flaw (CVE‑2020‑1938) gives an unauthenticated attacker who can reach the Apache JServ Protocol (AJP) connector the ability to read arbitrary files from the Tomcat server’s filesystem. The issue stems from Tomcat treating AJP traffic as inherently trusted, bypassing normal HTTP‑level access checks.
Exploitability – Public exploits and proof‑of‑concept code have been circulating since 2020; the vulnerability is rated CVSS v3 7.5 (High).
Affected Products – Apache Tomcat 7.x, 8.x, 9.x (all versions with the AJP connector enabled).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous configuration monitoring; a mis‑configured AJP endpoint defeats traditional perimeter controls.
- Provides a concrete control‑evidence gap: “Secure configuration management” must be demonstrable in audit logs to satisfy multiple frameworks (e.g., NIST CSF, ISO 27001).
- Enterprise buyers increasingly demand proof that such high‑impact misconfigurations are identified, remediated, and continuously verified.
Recommended Actions
- Patch: Upgrade to the latest Tomcat release that disables the vulnerable AJP behavior or applies the official security fix.
- Restrict Access: If AJP is required, bind it to localhost or a trusted subnet and enforce network‑level ACLs.
- Disable If Unused: Remove the AJP connector from
server.xmlwhen not needed. - Validate Controls: Capture configuration snapshots and log changes to demonstrate “secure configuration management” for audit purposes.
- Continuous Monitoring: Deploy automated scans that flag exposed AJP ports and verify remediation over time.
Source: CISA KEV – CVE‑2020‑1938