CVE-2020-1938

CVE-2020-1938-tomcat-File Download + File Inclusion Tomcat-Ajp protocol file read vulnerability】 Source POC source: https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC/blob/master/poc.py After modification, it can include files, and under certain conditions, execute commands...

ajpfuzzer

AJPFuzzer - A command-line fuzzer for AJPv1.3 AJPFuzzer is a rudimental fuzzer for the Apache JServ Protocol ajp13. Built on top of libajp13, the tool allows you to create and send AJP messages using an easy-to-use command line interface. AJPFuzzer can craft properly formatted AJP13 messages all...

CVE-2020-1938

CVE-2020-1938 CVE-2020-1938 fixes errors in the PoC from https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat.git and has been verified to work on Apache Tomcat/8.0.43. Practice Steps 1. Create docker-compose.yml 2. docker compose up -d 3. python3 CVE-2020-1938.py -p 8009 ...

CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner

Python2 Multithreaded Scanning for Tomcat-Ajp Protocol File Read Vulnerability A tool for scanning SRC rewards The PoC originates from https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi/, I am not the author of the PoC!!!! Operation 1. Place the domain/IP to be scanned in ip.txt Do not...

Ghostcat-CNVD-2020-10487

Ghostcat exp for CNVD-2020-10487CVE-2020-1938 tomcat ajp协议任意属性设置导致的文件读取和文件执行。 漏洞分析 代码仅供安全测试，请勿用于非法用途,造成的后果使用者负责与本人无关！！！ root@kitploit: python3 ajpShooter.py -h /\ / \ | | | //\ | | ' \ \ | ' \ / \ / | / \ '| / | | | | \ \ | | | | | || / | / // | ./ /| ||/ / \|| |/|| 00theway,just for test...

CVE-2020-1938

CVE-2020-1938 工具仅用于安全研究以及内部自查，禁止使用工具发起非法攻击，造成的后果使用者负责 apache-tomcat-8.5.32.zip 测试tomcat 任意文件读取 root@kitploit: java -jar 1.jar com.threedr3am.bug.tomcat.ajp.FileRead 127.0.0.1 8009 file /index.jsp 文件包含 root@kitploit: java -jar 1.jar com.threedr3am.bug.tomcat.ajp.FileRead 127.0.0.1 8009 jsp...

Ghostcat-Tomcat-AJP-Exploit-Py3

Tomcat Ghostcat CVE-2020-1938 / CNVD-2020-10487 漏洞检测工具 简介 本项目提供了一个用于验证 Apache Tomcat AJP 协议本地文件包含漏洞（俗称 Ghostcat 幽灵猫，CVE-2020-1938 / CNVD-2020-10487）的 Python 验证脚本。 此脚本基于最初流传的 Python 2 版本进行了全面重构与修复 ，完全兼容 Python 3 环境，修复了 StringIO、base64 编码以及二进制数据与字符串拼接时的兼容性问题，增强了在现代操作系统上的稳定性。 漏洞原理 Apache Tomcat 在处理...

CVE-2020-1938TomcatAjpScanner

CVE-2020-1938TomcatAjpScanner Escaneo masivo de la vulnerabilidad Tomcat AJP Detalles de la vulnerabilidad El 6 de enero de 2020, la plataforma nacional de intercambio de información sobre vulnerabilidades de seguridad CNVD registró la vulnerabilidad de inclusión de archivos de Apache Tomcat...

CVE-2020-1938-Tomcat-AJP-Ghostcat--Analysis

CVE-2020-1938 Tomcat AJP Ghostcat 分析 此仓库包含针对 CVE-2020-1938 Ghostcat 的 Markdown 分析报告以及报告中使用的图片素材。 目录 报告：docs/report/CVE-2020-1938-Analysis-Report.md 图片：docs/images 报告范围 报告围绕以下内容组织： 漏洞背景 使用 PoC 的攻击流程 基于 Tomcat 源代码的根本原因分析 文件读取和 JSP 执行的触发条件 Tomcat 9.0.30 和 9.0.31 之间的补丁对比 仓库结构 root@kitploit: docs/...

GhostCat-LFI-exp

GhostCat-LFI-exp CVE-2020-1938 EXP original: https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi Solo se modificó un lugar: ahora puede incluir ejecutar localmente cualquier archivo de cualquier proyecto...

tomcatfileread

CVE-2020-1938 Tomcat File Read / File Include Ghostcat — python3 CVE-2020-1938 CNVD-2020-10487 Tomcat AJP 协议文件读取 / 文件包含漏洞利用 POC 的 python3 转换版 。 原版（python2）作者: ydhcui — https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi 用法 root@kitploit: python3 "Tomcat-ROOT路径下文件包含CVE-2020-1938-python3.py" -...

CVE-2020-1938-Tool

CVE-2020-1938-Tool まず、AJPプロトコルリクエスト構築ツールAJPY（Pythonライブラリ）を提供してくれたhypn0sに感謝します。本プロジェクトはこれを基に、Ghostcat脆弱性サイトの一括検出を実装しています。 使い方 現在、2つの機能があります。 root@kitploit: usage: tomcat.py -h readfile,scanfiles ... positional arguments: readfile,scanfiles readfile Exploit CVE-2020-1938 scanfiles scan a file list...

httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue...

httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the AJP getter functions attempt to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause an out-of-bounds read. This issue leads to a denial of...

httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the ajpparsedata function attempts to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially lea...

Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow

A flaw was found in modproxyajp of Apache HTTP Server. This heap-based buffer overflow vulnerability allows a remote attacker, by connecting to a malicious AJP Apache JServ Protocol server, to send a specially crafted message. This message can cause modproxyajp to write attacker-controlled data...

CVE-Apache-Ecosystem

Apache Ecosystem CVE Vulnerability Reproduction Testbed D...

undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

UBUNTU-CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

EUVD-2026-55981

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...