CVE-2020-1938

What is the Apache Tomcat AJP Connector?

Apache Tomcat is the most widely deployed open-source Java Servlet container, running the backend of a vast range of Java web applications. Alongside its standard HTTP connector, Tomcat ships an AJP (Apache JServ Protocol) connector — a binary protocol meant for communication between Tomcat and a front-end web server like Apache httpd, historically assumed to sit on a trusted internal network rather than be reachable by untrusted clients directly.

Overview

CVE-2020-1938, dubbed "Ghostcat" by the Chaitin Tech researchers who discovered it, exists because Tomcat's AJP connector grants a connecting client a level of trust closer to that of the server process itself than to an ordinary HTTP request. A remote, unauthenticated attacker who can reach the AJP port (default 8009) can use it to read arbitrary files from anywhere within a web application — including configuration files like WEB-INF/web.xml that may contain credentials or sensitive application logic — and, on applications that support file uploads, to include and execute a maliciously uploaded file, achieving full remote code execution.

Affected Versions

Technical Details

The AJP connector is enabled by default on many Tomcat installations even when it isn't in active use, and historically had no built-in restriction limiting it to trusted internal hosts. An attacker who can reach the AJP port can craft requests using AJP's ghost.cattr request attributes to instruct Tomcat to read and return the contents of any file within the web application's context, or to have Tomcat process an attacker-supplied file as a JSP page if the application allows file uploads — turning an arbitrary file read into remote code execution (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical, per CISA's KEV entry).

Discovery

Discovered and responsibly disclosed by researchers at Chaitin Tech (长亭科技), who reported it to the Apache Tomcat project ahead of coordinated public disclosure.

Exploitation Context

Mass scanning for exposed AJP ports began within days of the February 2020 disclosure, given how simple the exploitation primitive is (a handful of AJP requests, no authentication) and how widely deployed Tomcat is across enterprise Java applications. CISA later added the CVE to KEV based on continued confirmed exploitation of unpatched, internet-exposed instances.

Remediation

1. Upgrade to a fixed Tomcat version (9.0.31+, 8.5.51+, or 7.0.100+) — later versions also disable the AJP connector by default unless explicitly configured, closing the exposure even if the connector isn't in use.
2. If the AJP connector isn't required, disable it entirely in server.xml, regardless of patch status.
3. If AJP is required for a reverse proxy setup, bind it to localhost or an internal-only interface and never expose port 8009 to untrusted networks.
4. Configure the requiredSecret (or address) attribute on the AJP connector as defense-in-depth, restricting which hosts may connect.