A brief update regarding the Ghostcat vulnerability (CVE-2020-1938) that affects Apache Tomcat servers.
According to a tweet by cyber threat intelligence firm Bad Packets, "mass scanning activity targeting this vulnerability has already begun":
The attack perimeter is huge: according to Shodan , more than 890,000 Tomcat servers are currently reachable over the Internet.
More information about patching/mitigations are available on my previous post.
Patch, patch ASAP!
- Apache Tomcat AJP Ghostcat File Read / Inclusion
- Ghostcat bug impacts all Apache Tomcat versions released in the last 13 years - ZDNet
- 13-year-old Ghostcat Bug Affected Apache-Tomcat Let Hackers Remotely Inject Any Files in The Servers - GBHackers
- CVE-2020-1938: Ghostcat aka Tomcat 9/8/7/6 in the default configuration (port 8009) leading to disclosure of configuration files and source code files of all webapps deployed and potentially code execution - REDDIT