CVE-2020-1938: Ghostcat
A flaw in how Apache Tomcat's AJP connector processes requests, letting an attacker with network access to the AJP port (8009 by default) read arbitrary files from within a web application, such as configuration files containing credentials, or, if the application also allows file uploads, include and execute an uploaded file for remote code execution.
View the authoritative record on NVD ↗Affected software
- Apache Tomcat 6 (all versions, end of life)
- Apache Tomcat 7 before 7.0.100
- Apache Tomcat 8 before 8.5.51
- Apache Tomcat 9 before 9.0.31
How it's exploited
Send a crafted request directly to the exposed AJP connector port requesting an arbitrary file path within the web application (such as WEB-INF/web.xml), which Tomcat returns without proper access control; if the application also has a file upload feature, first upload a JSP webshell, then use the same AJP request path to have Tomcat include and execute it.
Severity
CVE-2020-1938 carries a CVSS 3.1 base score of 9.8, rated Critical. See how CVSS scoring works or score a vulnerability yourself with the free CVSS calculator.
Weakness type
CVE-2020-1938 is categorized under CWE-284, the general weakness pattern behind this specific vulnerability.
How TurboPentest tests for this (white-box)
This weakness (Improper Access Control) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 1 rule for it, flagging the issue directly in your source code as part of the pentest.
Remediation
Upgrade to a fixed Tomcat version, and regardless of version, never expose the AJP connector to untrusted networks, bind it to localhost only or disable it entirely if it is not needed.
Frequently asked questions
What is CVE-2020-1938?
A flaw in how Apache Tomcat's AJP connector processes requests, letting an attacker with network access to the AJP port (8009 by default) read arbitrary files from within a web application, such as configuration files containing credentials, or, if the application also allows file uploads, include and execute an uploaded file for remote code execution.
How severe is CVE-2020-1938?
CVE-2020-1938 has a CVSS 3.1 base score of 9.8 out of 10, rated Critical.
What software is affected by CVE-2020-1938?
CVE-2020-1938 affects Apache Tomcat 6 (all versions, end of life); Apache Tomcat 7 before 7.0.100; Apache Tomcat 8 before 8.5.51; Apache Tomcat 9 before 9.0.31.
How do you fix CVE-2020-1938?
Upgrade to a fixed Tomcat version, and regardless of version, never expose the AJP connector to untrusted networks, bind it to localhost only or disable it entirely if it is not needed.
Where is the authoritative record for CVE-2020-1938?
The National Vulnerability Database (NVD) publishes the authoritative record for CVE-2020-1938 at https://nvd.nist.gov/vuln/detail/CVE-2020-1938, including the current CVSS score, CWE mapping, and affected-configuration data.
Related CVEs
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find known-vulnerable services before an attacker does
TurboPentest fingerprints every open port and web service, then matches detected versions against known CVEs automatically, from $99 per target.
Start a pentest