tomcat – Page 3 – WindowsTechs.com

Nexus Intelligence Insights: What’s in a Ghostcat? CVE-2020-1938 Apache Tomcat – Local File Inclusion Potentially Leads to RCE

Posted on March 9, 2020 by Akshay 'Ax' Sharma

For this month’s Nexus Intelligence Insights, let’s dive deep into the popular Ghostcat vulnerability making headlines recently.
This vulnerability deserves attention as it impacts the widely used Apache Tomcat web server, has at least… Continue reading Nexus Intelligence Insights: What’s in a Ghostcat? CVE-2020-1938 Apache Tomcat – Local File Inclusion Potentially Leads to RCE→

Automatically Discover, Prioritize and Remediate Apache Tomcat AJP File Inclusion Vulnerability (CVE-2020-1938) using Qualys VMDR

Posted on March 6, 2020 by Animesh Jain

A severe vulnerability exists in Apache Tomcat’s Apache JServ Protocol. The Chinese cyber security company Chaitin Tech discovered the vulnerability, which is named “Ghostcat” and is tracked using CVE-2020-1938. The security issu… Continue reading Automatically Discover, Prioritize and Remediate Apache Tomcat AJP File Inclusion Vulnerability (CVE-2020-1938) using Qualys VMDR→

CVE-2020-1938 LFI how to escape webapp ROOT

Posted on February 26, 2020 by su13

I have a question regarding CVE-2020-1938. I am using following tool to exploit vulnerability https://github.com/hypn0s/AJPy
but I am only able to include files from ROOT webapp. How can I escape this folder and read other files from file … Continue reading CVE-2020-1938 LFI how to escape webapp ROOT→

Is Tomcat protecting against CSRF correctly?

Posted on February 25, 2020 by Johnny

If I read this correctly the way Tomcat protects against CSRF leaves it vulnerable to the situation where the CSRF token is duplicated in the cookie and request parameters which allows the attacker to simply invent a token (as detailed her… Continue reading Is Tomcat protecting against CSRF correctly?→

Tomcat AJP vulnerability CVE-2020-1938 aka Ghostcat

Posted on February 24, 2020 by Matt

I have a question about Tomcat vulnerability CVE-2020-1938 aka Ghostcat. The security researcher who discovered the vulnerability created a write up here: https://www.chaitin.cn/en/ghostcat and a PoC here: https://github.com/YDHCUI/CNVD-20… Continue reading Tomcat AJP vulnerability CVE-2020-1938 aka Ghostcat→

Should I regenerate SSL certificates after upgrading Openssl

Posted on November 12, 2019 by Sadmi

As you may already know old Openssl versions were vulnerable(OpenSSL 1.0.1 through 1.0.1f (inclusive)) by the HeartBleed vulnerability. Currently our server is running Tomcat7 which is built in a vulnerable Openssl, so we upg… Continue reading Should I regenerate SSL certificates after upgrading Openssl→

I think my server has been compromised

Posted on October 13, 2019 by toom

I have a server and it is generating a significant outgoing traffic to specific destinations.

I checked data traffic with vnstats.

The output is:

$ vnstat –days

eth0 / daily

day rx | tx … Continue reading I think my server has been compromised→

Using certificate on same server but different port for https

Posted on October 1, 2019 by user218781

I have taken a working HTTPS certificate from a server that I want to use on the same server, just on a different port. The certificate has a Subject Alternative Name defined in it. Using keytool, I generated a new keystore… Continue reading Using certificate on same server but different port for https→

Tomcat OIDC Authenticated Realm

Posted on June 12, 2019 by Archangel33

I am currently using a tomcat authenticator implementation (https://github.com/boylesoftware/tomcat-oidcauth). The authenticator is implemented as a tomcat valve. This implementation still requires a realm to be used, which i… Continue reading Tomcat OIDC Authenticated Realm→

includeSubDomains is not shown in https header after enabling hstsIncludeSubDomains in Tomcat

Posted on May 25, 2019 by Fredy

I enabled HSTS in the Tomcat web.xml like this:

<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
… Continue reading includeSubDomains is not shown in https header after enabling hstsIncludeSubDomains in Tomcat→