UIM 8.5.1 SEVERITY: High - Vulnerability found for: Apache Tomcat AJP Connector Request Injection (Ghostcat)

[NGHIA VAN]

Is there a remediation for this vulnerability for UMP in uim 8.5.1?

PORT: 8009
CVE: CVE-2020-1745,CVE-2020-1938
EXPLOITABLE: Yes
SEVERITY: High
RISK FACTOR: High
PLUGIN ID: 134862
PLUGIN NAME: Apache Tomcat AJP Connector Request Injection (Ghostcat)

PLUGIN TEXT:
<plugin_output>
Nessus was able to exploit the issue using the following request :

0x0000: 02 02 00 08 48 54 54 50 2F 31 2E 31 00 00 0F 2F ....HTTP/1.1.../
0x0010: 61 73 64 66 2F 78 78 78 78 78 2E 6A 73 70 00 00 asdf/xxxxx.jsp..
0x0020: 09 6C 6F 63 61 6C 68 6F 73 74 00 FF FF 00 09 6C .localhost.....l
0x0030: 6F 63 61 6C 68 6F 73 74 00 00 50 00 00 09 A0 06 ocalhost..P.....
0x0040: 00 0A 6B 65 65 70 2D 61 6C 69 76 65 00 00 0F 41 ..keep-alive...A
0x0050: 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 00 00 ccept-Language..
0x0060: 0E 65 6E 2D 55 53 2C 65 6E 3B 71 3D 30 2E 35 00 .en-US,en;q=0.5.
0x0070: A0 08 00 01 30 00 00 0F 41 63 63 65 70 74 2D 45 ....0...Accept-E
0x0080: 6E 63 6F 64 69 6E 67 00 00 13 67 7A 69 70 2C 20 ncoding...gzip,
0x0090: 64 65 66 6C 61 74 65 2C 20 73 64 63 68 00 00 0D deflate, sdch...
0x00A0: 43 61 63 68 65 2D 43 6F 6E 74 72 6F 6C 00 00 09 Cache-Control...
0x00B0: 6D 61 78 2D 61 67 65 3D 30 00 A0 0E 00 07 4D 6F max-age=0.....Mo
0x00C0: 7A 69 6C 6C 61 00 00 19 55 70 67 72 61 64 65 2D zilla...Upgrade-
0x00D0: 49 6E 73 65 63 75 72 65 2D 52 65 71 75 65 73 74 Insecure-Request
0x00E0: 73 00 00 01 31 00 A0 01 00 09 74 65 78 74 2F 68 s...1.....text/h
0x00F0: 74 6D 6C 00 A0 0B 00 09 6C 6F 63 61 6C 68 6F 73 tml.....localhos
0x0100: 74 00 0A 00 21 6A 61 76 61 78 2E 73 65 72 76 6C t...!javax.servl
0x0110: 65 74 2E 69 6E 63 6C 75 64 65 2E 72 65 71 75 65 et.include.reque
0x0120: 73 74 5F 75 72 69 00 00 01 31 00 0A 00 1F 6A 61 st_uri...1....ja
0x0130: 76 61 78 2E 73 65 72 76 6C 65 74 2E 69 6E 63 6C vax.servlet.incl
0x0140: 75 64 65 2E 70 61 74 68 5F 69 6E 66 6F 00 00 10 ude.path_info...
0x0150: 2F 57 45 42 2D 49 4E 46 2F 77 65 62 2E 78 6D 6C /WEB-INF/web.xml
0x0160: 00 0A 00 22 6A 61 76 61 78 2E 73 65 72 76 6C 65 ..."javax.servle
0x0170: 74 2E 69 6E 63 6C 75 64 65 2E 73 65 72 76 6C 65 t.include.servle
0x0180: 74 5F 70 61 74 68 00 00 00 00 FF t_path.....



This produced the following truncated output (limited to 10 lines) :
------------------------------ snip ------------------------------
...&lt;?xml version="1.0"?&gt;

&lt;web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="Liferay_Portal" version="2.4" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"&gt;
&lt;context-param&gt;
&lt;param-name&gt;axis.servicesPath&lt;/param-name&gt;
&lt;param-value&gt;/api/axis/&lt;/param-value&gt;
&lt;/context-param&gt;
&lt;context-param&gt;
&lt;param-name&gt;contextClass&lt;/param-name&gt;
&lt;param-value&gt;com.liferay.portal.spring.context.PortalApplicationContext&lt;/param-value&gt;
[...]

------------------------------ snip ------------------------------
</plugin_output>

SYNOPSIS:
There is a vulnerable AJP connector listening on the remote host.

DESCRIPTION:
A file read/inclusion vulnerability was found in AJP connector. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and gain remote code execution (RCE).

SOLUTION:
Update the AJP configuration to require authorization and/or upgrade the Tomcat server to 7.0.100, 8.5.51, 9.0.31 or later.

See Also:
http://www.nessus.org/u?8ebe6246
http://www.nessus.org/u?4e287adb
http://www.nessus.org/u?cbc3d54e
https://access.redhat.com/security/cve/CVE-2020-1745
https://access.redhat.com/solutions/4851251
http://www.nessus.org/u?dd218234
http://www.nessus.org/u?dd772531
http://www.nessus.org/u?2a01d6bf
http://www.nessus.org/u?3b5af27e
http://www.nessus.org/u?9dab109f
http://www.nessus.org/u?5eafcf70

[David Michel]

yes upgrade UIM

With 9.02 this was version 7.0.81.
for 9.2.0 it's 9.0.16
for 20.1 it's 9.0.31

available via
http://<umpIP>:<Port>/usm/jsp/diag.jsp

------------------------------
Support Engineer
Broadcom
------------------------------

[NGHIA VAN]

Is there a remediation without the upgrade?  RIght now upgrades are not the answer since NIMSOFT/UIM/DX IM (whatever we are calling it these days)does not have a clear upgrade path.  The 20.1 upgrade does not resolve the flash issue that is coming at the end of the year even though there was discussion that this release would be the answer only to find out it is being punted and promised for 20.3 which is yet to come with little detail about the path.  The roadmap presentations just pose more questions on how to deliver the same functionalities we have today with the significant overhauls that are happening....so no just upgrading is not as simple as Broadcom makes it out to be...nor is it feasible for businesses to upgrade multiple times a year with out months of lead time.

[Matthias Gruber]

Absolutely my opinion!
Cancelling 8.5.1 Support without further notice is bad behaviour, but how ever...I do not expect much anymore from Broadcom for us :-) just a "do or die" and some marketing-sentences :-) (only me little opinion)

Cheers
Matthias

[Mark DeBoer]

Except that the upgrade UIM to 20.1 breaks the working of the httpd reverse proxy, as in our case.

Seems AJP connector 9.0.31 workd differently than 9.0.16 and nobody seems to know how.

And yes, we did add secretRequired = false in the wasp.cfg.

[NGHIA VAN]

Anyone have a idea other than to do a full upgrade and inherit a new set of unknown problems only to have to do another upgrade later this year when flash goes away and have to live with what ever comes out of that since it is currently still unknown?

[Ivan Gasparec]

I don't what is AJP Connector used for.
I have disabled AJP in my demo environment and it look like that everything is working. 
You can disable port in the wasp configuration file, just comment two lines for AJP.

[NGHIA VAN]

this seems to have fixed the vulnerability issue from the nessus/security center scan perspective.  Thank you for providing a solution besides upgrade.

[Emery Clark]

Can you please share what the exact solution was?

[Gene Howard]

I believe what they did was to edit the wasp.cfg to disable the ajp keys
by default in 8.5x there are these two keys in the ump wasp.cfg
<setup>
ajp_port = 8009
ajp_max_threads = 250


------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Emery Clark]

So, remove those values from the config?
What is the AJP used for and what are the effects of disabling this?

[Gene Howard]

See the below on what the AJP connector is:
https://tomcat.apache.org/tomcat-7.0-doc/config/ajp.html

this should not cause a problem with OOTB operations of UMP.

@Ivan Gasparec​ can you provide what you did exactly to disable this?

I tried removing these keys but wasp would not start as well as just setting the port to 0 So I am unclear how this was done.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[NGHIA VAN]

I removed the 2 lines from the cgf and then started wasp back....running just fine for now...portal loads etc.  when i open the wasp probe i do notice the ajp port is empty in the gui

[Gene Howard]

you can double-check netstat and make sure there is nothing listening on the 8009 port and have your security team run a quick scan to double check.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[NGHIA VAN]

, Gene, I was just explaining what we did to fix it, our system has already been re scanned and confirmed that it is mitigated in a previous post in this thread.

[Gene Howard]

great thanks for the help!!!

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Ivan Gasparec]

@Gene Howard ​

I just commented out two lines in wasp.cfg file and restarted wasp probe:

#ajp_max_threads = 250
#ajp_port = 8009

[Emery Clark]

Do you know if this was fixed in 20.1 ?

[Gene Howard]

by default, these are still enabled in 20.1

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Dan Gill]

If you set up your UMP to work using a DMZ, you'll use AJP.

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/unified-infrastructure-management/9-0-2/installing/optional-post-installation-tasks/set-up-access-to-ump-using-a-dmz.html