CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner

python2 멀티스레드 Tomcat-Ajp 프로토콜 파일 읽기 취약점 스캔 src 점수를 얻는 복지 poc 출처: https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi/，poc 작성자는 본인이 아닙니다!!!! 사용법 1、스캔할 도메인/IP를 ip.txt에 입력 ip.txt에는 프로토콜을 추가할 필요가 없습니다. 예: root@kitploit: 127.0.0.1 www.baidu.com www.google.com 2、python threading-find-port-8009.py...

CVE-2020-1938-Tool

CVE-2020-1938-Tool Zunächst danken wir hypn0s für die Bereitstellung des Tools AJPY zur Erstellung von AJP-Protokollanfragen eine Python-Bibliothek. Auf dieser Grundlage realisiert dieses Projekt die Stapelerkennung von Ghostcat-Schwachstellen-Websites. Verwendung Derzeit gibt es zwei Funktionen...

CVE-2020-1938

CVE-2020-1938 이 도구는 보안 연구 및 내부 자체 점검에만 사용해야 하며, 도구를 이용한 불법 공격은 금지됩니다. 이로 인해 발생하는 모든 결과에 대한 책임은 사용자에게 있습니다. apache-tomcat-8.5.32.zip 테스트용 tomcat 임의 파일 읽기 root@kitploit: java -jar 1.jar com.threedr3am.bug.tomcat.ajp.FileRead 127.0.0.1 8009 file /index.jsp 파일 포함 root@kitploit: java -jar 1.jar...

CVE-2020-1938TomcatAjpScanner

CVE-2020-1938TomcatAjpScanner 대량 스캔 Tomcat AJP 취약점 취약점 상세 2020년 1월 6일, 중국 국가정보보안취약점공유플랫폼CNVD은 Apache Tomcat 파일 포함 취약점CNVD-2020-10487, CVE-2020-1938에 해당을 등록했습니다. 공격자는 이 취약점을 이용해 인증 없이 특정 디렉터리 아래의 임의 파일을 원격으로 읽을 수 있습니다. 현재 취약점 세부 사항은 공개되지 않았으며, 공급업체는 취약점을 수정한 새 버전을 출시했습니다. 취약점 분석...

CVE-2020-1938

CVE-2020-1938-tomcat-文件下载+文件包含 Tomcat-Ajp协议文件读取漏】 源poc来源：https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC/blob/master/poc.py 修改后可包含文件，在某些条件下可以执行命令...

CVE-2020-1938-Tomcat-AJP-Ghostcat--Analysis

CVE-2020-1938 Tomcat AJP Ghostcat 분석 이 저장소는 CVE-2020-1938 Ghostcat에 대한 Markdown 분석 보고서와 보고서에 사용된 이미지 자산을 포함합니다. 목차 보고서: docs/report/CVE-2020-1938-Analysis-Report.md 이미지: docs/images 보고서 범위 보고서는 다음 내용을 중심으로 구성됩니다: 취약점 배경 PoC를 이용한 공격 흐름 Tomcat 소스 코드 기반 근본 원인 분석 파일 읽기 및 JSP 실행을 위한 트리거 조건 Tomcat...

GhostCat-LFI-exp

GhostCat-LFI-exp CVE-2020-1938 मूल EXP：https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi केवल एक स्थान को संशोधित किया गया है, जो किसी भी प्रोजेक्ट के अंतर्गत किसी भी फाइल को स्थानीय रूप से शामिल निष्पादित कर सकता है।...

CVE-2020-1938

CVE-2020-1938 Questa CVE-2020-1938 corregge l'errore del PoC di https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat.git e ne ha verificato il funzionamento con Apache Tomcat/8.0.43. Metodo di esercitazione 1. Creare docker-compose.yml 2. docker compose up -d 3. python3...

ajpfuzzer

AJPFuzzer - Un fuzzer da riga di comando per AJPv1.3 AJPFuzzer è un fuzzer rudimentale per il Apache JServ Protocol ajp13. Costruito sopra libajp13, lo strumento permette di creare e inviare messaggi AJP usando un'interfaccia a riga di comando facile da usare. AJPFuzzer può creare messaggi AJP13...

Ghostcat-CNVD-2020-10487

Ghostcat Exploit für CNVD-2020-10487 CVE-2020-1938 Dateilesen und Dateiausführung durch beliebige Attributsetzung im Tomcat AJP-Protokoll. Schwachstellenanalyse Der Code dient ausschließlich Sicherheitstests. Verwenden Sie ihn nicht für illegale Zwecke. Der Benutzer trägt die alleinige...

Ghostcat-Tomcat-AJP-Exploit-Py3

Strumento di rilevamento della vulnerabilità Tomcat Ghostcat CVE-2020-1938 / CNVD-2020-10487 Introduzione Questo progetto fornisce uno script Python per verificare la vulnerabilità di inclusione locale di file nel protocollo AJP di Apache Tomcat comunemente nota come Ghostcat, CVE-2020-1938 /...

CVE-Apache-Ecosystem

Apache Ecosystem CVE Vulnerability Reproduction Testbed D...

undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

UBUNTU-CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

EUVD-2026-55981

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

RHEL 8 : httpd:2.4 (RHSA-2026:36373)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36373 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP...

SUSE-SU-2026:2377-1 Security update for tomcat10

This update for tomcat10 fixes the following issues Update to Tomcat 10.1.55: - CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling bsc1265162. - CVE-2026-41293: HTTP/2 request headers not validated bsc1265163. - CVE-2026-42498: WebSocket authentication header exposure bsc1265165....

httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the AJP getter functions attempt to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause an out-of-bounds read. This issue leads to a denial of...

httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue...

BIT-TOMCAT-2020-1938

When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that...