0

I would like to know if the ghostcat bug can be exploited through an Apache web server reverse proxy setup.

This is our web server config.

<VirtualHost *:80>
ServerName 192.168.178.1    
ProxyPass / ajp://127.0.0.1:8009/sample/ 
ProxyPassReverse "^/(.*)" /sample/
ProxyPassReverseCookiePath /sample/ /
</VirtualHost>

I've tried to use some exploits from GitHub, but they only seem to work through the Apache JServ Protocol port (8009) directly, and not through the reverse proxy (80). Does this mean that applications running behind reverse proxies are safe?

Or is it possible to make use of the vulnerability, since Apache is simply forwarding all traffic to the AJP.

We are also sometimes using a simple RewriteRule to redirect to the AJP

RewriteRule / ajp://127.0.0.1:8009/sample/ [P]

Which one is more secure?

Improve this question
2
  • 1
    Why not be on the safe side and update tomcat?
    – Panki
    Mar 5, 2020 at 10:59
  • 1
    We have around 30 - 50 different tomcats on different servers. We would like to know if we really need to update every single one as fast as possible, or if we can take this slowly
    – elements518
    Mar 5, 2020 at 11:56

1 Answer 1

Reset to default
0

CVE-2020-1938 cannot be exploited through a reverse proxy - only by direct connection to an AJP port.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .