I would like to know if the ghostcat bug can be exploited through an Apache web server reverse proxy setup.

This is our web server config.

<VirtualHost *:80>
ProxyPass / ajp:// 
ProxyPassReverse "^/(.*)" /sample/
ProxyPassReverseCookiePath /sample/ /

I've tried to use some exploits from GitHub, but they only seem to work through the Apache JServ Protocol port (8009) directly, and not through the reverse proxy (80). Does this mean that applications running behind reverse proxies are safe?

Or is it possible to make use of the vulnerability, since Apache is simply forwarding all traffic to the AJP.

We are also sometimes using a simple RewriteRule to redirect to the AJP

RewriteRule / ajp:// [P]

Which one is more secure?

  • 1
    Why not be on the safe side and update tomcat? – Panki Mar 5 '20 at 10:59
  • 1
    We have around 30 - 50 different tomcats on different servers. We would like to know if we really need to update every single one as fast as possible, or if we can take this slowly – elements518 Mar 5 '20 at 11:56

CVE-2020-1938 cannot be exploited through a reverse proxy - only by direct connection to an AJP port.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.