Hello. I'm eastpost.
I have to blog, but now I'm starting.
I write for a few days because I know it's too hard to know by myself.
Among the maintenance sites I'm in charge of, I got a notice of a security update advisory request from a person in charge.
In fact, I was using the 2015 build Tomcat 7.0.61 with very few updates, so there was a need for updates. The server was frequently unresponsive (503 error), so I was constantly monitoring and rebooting.
The recommendations are as follows:
Apache Tomcat AJP Vulnerability Security Action Advisory (Second) 2020.03.02
□ Overview
o A proof of concept code (PoC) that could exploit the latest Apache Tomcat remote code execution vulnerability (CVE-2020-1938) Need to enhance user's security by being disclosed on the screen
※ Concept proof code: Program or source code that can prove / verify vulnerability
□ Description
o When Tomcat processes AJP request message, remote code that occurs due to insufficient processing of message Execution Vulnerability (CVE-2020-1938)
※ AJP (Apache JServ Protocol): Protocol that forwards connection request between web server and application server using port 8009. (Monitoring function supported)
□ Affected Version
o Apache Tomcat
-9.0. 0.M1 ~ 9.0.30-8.5.0
~ 8.5.50-7.0.0
~ 7.0.99
※ The above version is affected by the vulnerability because AJP connector is enabled by default.
□ Solution
o Refer to the page for each version. By Choi Apply updated version
- version 7.0.100 or later
- version 8.5.51 or later
-Version 9.0.31 or later
o Temporary measures (difficult to apply patch) -Deactivating
connector when AJP function is unnecessary
· Commenting on AJP Connector function in conf / server.xml configuration file
□ Other questions
o Korea Internet Development Agency Cyber Complaint Center : Without
reference 118 [reference site]
[1] https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E
[2] http://tomcat.apache.org /security-7.html
[3] http://tomcat.apache.org/security-8.html
[4] http://tomcat.apache.org/security-9.html
KISA-Apache Tomcat Vulnerability Security Advisory (1st)
KISA-Apache Tomcat AJP Vulnerability Security Action Advisory (2nd)
more information about the vulnerability
my mail When I received it, there was no solution, but it was added.
A serious vulnerability related to the Apache JServ Protocol (AJP), which links Apache and Tomcat servers, seems to have been in haste by Apache.
The maintenance site I managed was also a way to expose Tomcat server pages by domain when Apache server received a response. The production server was running three Tomcat servers using VirtualHost. The other two Tomcat servers were scary to touch Apache, not my site. (Fortunately, there was nothing to fix.)
First, let's run the sh version.sh in Tomcat's bin directory to check the version.
In my case, it was 7.0.61 version, so I had to update to 7.0.100 version.
It's been less than a month since the vulnerability version was released (based on 20/3/6), so everyone will need to update it ...
Tomcat build archive link. Find the latest version. (You can find quickly Look out for a "2020")
those who need patches before he has haedu Tomcat up everything ...
you need to modify the conf / server.xml .
Before that you need to check your Apache server version.
Run httpd -v to check the version.
If you are under 2.4.42 or later, you can set differently.
In my case, it was 2.2.15 version and it was difficult to update, so I dealt with less than 2.4.42 version. In fact, even more than that version is probably the way to apply .. It seems that this is the only version below 2.4.42.
If you look to open the server.xml,
<-! the Define an AJP 1.3 Connector on Port 8009 ->
<Connector Port = "8009" Protocol = "AJP / 1.3" redirectPort = "8443" />
will be tagged in this way, . (The port number may be different depending on the operating environment.)
If AJP is written in the protocol, it may be considered that you are using AJP. However, some existing users may not be using the tag because it is basically embedded.
If you don't use it, it's best to delete the tag. If you use it like this, write the tag as follows. (If Apache 2.4.42 or lower)
<Connector port = "8009" protocol = "AJP / 1.3" redirectPort = "8443" address = ":: 1" secretRequired = "false"
or
<Connector port = "8009" protocol = "AJP / 1.3" redirectPort = "8443" address = "0.0.0.0" secretRequired = "false" />
address: Enter the address used. You can put :: 1 like me or 0: 0: 0: 0.
secretRequired: Setting whether secret value (authentication key) is required. Put false
It's not an exaggeration to say that they're shoveled because of the address attribute. I've also had a problem when trying to put in a private IP, public IP, or domain that starts with localhost, 127.0.0.1, 192.168.
Makes had any problems ..
Service Temporarily Unavailable
The Server is temporarily Unable to Service Your Due to the Request Maintenance Downtime Capacity or the Problems. Please try again later.
This page is still visible. In fact, the explanation below didn't help one.
Tomcat server started normally.
There is a guy named mod_jk that emits AJP related logs from Apache.
tail -f mod_jk.log
[Thu Mar 05 17: 19: 16.222 2020] [18908: 140515944781792] [info] jk_open_socket :: jk_connect.c (817): connect to :: 1: 8309 failed (errno = 111)
[Thu Mar 05 17:19: 16.222 2020] [18908: 140515944781792] [info] ajp_connect_to_endpoint :: jk_ajp_common.c (1068): (projNm) Failed opening socket to (:: 1: 8309) (errno = 111)
[Thu Mar 05 17: 19: 16.222 2020 [18908: 140515944781792] [error] ajp_send_request :: jk_ajp_common.c (1728): (projNm) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno = 111)
[Thu Mar 05 17: 19: 16.222 2020] [18908: 140515944781792] [info] ajp_service :: jk_ajp_common.c (2773): (projNm) sending request to tomcat failed (recoverable), because of error during request sending (attempt = 1)
[Thu Mar 05 17: 19: 16.322 2020] [18908: 140515944781792] [info] jk_open_socket :: jk_connect.c (817): connect to :: 1: 8309 failed (errno = 111)
[Thu Mar 05 17:19: 16.322 2020] [18908: 140515944781792] [info] ajp_connect_to_endpoint :: jk_ajp_common.c (1068): (projNm) Failed opening socket to (:: 1: 8309) (errno = 111)
[Thu Mar 05 17: 19: 16.322 2020 [18908: 140515944781792] [error] ajp_send_request :: jk_ajp_common.c (1728): (projNm) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno = 111)
[Thu Mar 05 17: 19: 16.322 2020] [18908: 140515944781792] [info] ajp_service :: jk_ajp_common.c (2773): (projNm) sending request to tomcat failed (recoverable), because of error during request sending (attempt = 2)
[Thu Mar 05 17: 19: 16.322 2020] [18908: 140515944781792] [error] ajp_service :: jk_ajp_common.c (2794): (projNm) connecting to tomcat failed (rc = -3, errors = 821, client_errors = 46) .
[Thu Mar 05 17: 19: 16.322 2020] [18908: 140515944781792] [info] jk_handler :: mod_jk.c (2991): Service error = -3 for worker = projNm
[Thu Mar 05 17: 19: 16.373 2020] [ 24073: 140515944781792] [info] jk_open_socket :: jk_connect.c (817): connect to :: 1: 8309 failed (errno = 111)
[Thu Mar 05 17: 19: 16.373 2020] [24073: 140515944781792] [info] ajp_connect_to_endpoint :: jk_ajp_common.c (1068): (projNm) Failed opening socket to (:: 1: 8309) (errno = 111)
[Thu Mar 05 17: 19: 16.373 2020] [24073: 140515944781792] [error] ajp_send_request :: jk_ajp_common.c (1728): (projNm) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno = 111)
[Thu Mar 05 17: 19: 16.373 2020] [24073: 140515944781792] [info] ajp_service :: jk_ajp_common.c (2773): (projNm) sending request to tomcat failed (recoverable), because of error during request sending (attempt = 1)
[Thu Mar 05 17: 19: 16.474 2020] [24073: 140515944781792] [info] jk_open_socket :: jk_connect.c (817): connect to :: 1: 8309 failed (errno = 111)
[Thu Mar 05 17: 19: 16.474 2020] [24073: 140515944781792] [info] ajp_connect_to_endpoint :: jk_ajp_common.c (1068): (projNm) Failed opening socket to (:: 1: 8309) (errno = 111)
[Thu Mar 05 17: 19: 16.474 2020] [24073: 140515944781792] [error] ajp_send_request :: jk_ajp_common.c (1728): (projNm) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno = 111)
[Thu Mar 05 17: 19: 16.474 2020] [24073: 140515944781792] [info] ajp_service :: jk_ajp_common.c (2773): (projNm) sending request to tomcat failed (recoverable), because of error during request sending (attempt = 2)
[Thu Mar 05 17: 19: 16.474 2020] [24073: 140515944781792] [error] ajp_service :: jk_ajp_common.c (2794): (projNm ) connecting to tomcat failed (rc = -3, errors = 822, client_errors = 46).
[Thu Mar 05 17: 19: 16.474 2020] [24073: 140515944781792] [info] jk_handler :: mod_jk.c (2991): Service error = -3 for worker = projNm
[Thu Mar 05 17: 19: 21.277 2020] [20326: 140515944781792] [info] jk_open_socket :: jk_connect.c (817): connect to :: 1: 8309 failed (errno = 111)
[Thu Mar 05 17:19: 21.277 2020] [20326: 140515944781792] [info] ajp_connect_to_endpoint :: jk_ajp_common.c (1068): (projNm) Failed opening socket to (:: 1: 8309) (errno = 111)
[Thu Mar 05 17: 19: 21.278 2020 [20326: 140515944781792] [error] ajp_send_request :: jk_ajp_common.c (1728): (projNm) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno = 111)
[Thu Mar 05 17: 19: 21.278 2020] [20326: 140515944781792] [info] ajp_service :: jk_ajp_common.c (2773): (projNm) sending request to tomcat failed (recoverable), because of error during request sending (attempt = 1)
[Thu Mar 05 17: 19: 21.378 2020] [20326: 140515944781792] [info] jk_open_socket :: jk_connect.c (817): connect to :: 1: 8309 failed (errno = 111)
[Thu Mar 05 17:19: 21.378 2020] [20326: 140515944781792] [info] ajp_connect_to_endpoint :: jk_ajp_common.c (1068): (projNm) Failed opening socket to (:: 1: 8309) (errno = 111)
[Thu Mar 05 17: 19: 21.378 2020 [20326: 140515944781792] [error] ajp_send_request :: jk_ajp_common.c (1728): (projNm) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno = 111)
[Thu Mar 05 17: 19: 21.378 2020] [20326: 140515944781792] [info] ajp_service :: jk_ajp_common.c (2773): (projNm) sending request to tomcat failed (recoverable), because of error during request sending (attempt = 2)
[Thu Mar 05 17: 19: 21.378 2020] [20326: 140515944781792] [error] ajp_service :: jk_ajp_common.c (2794): (projNm) connecting to tomcat failed (rc = -3, errors = 823, client_errors = 46) .
[Thu Mar 05 17: 19: 21.378 2020] [20326: 140515944781792] [info] jk_handler :: mod_jk.c (2991): Service error = -3 for worker = projNm
(In my case the port is 8309, not 8009. )
to ::1:8309 IP was an IPv6 localhost IP, unthinkable. ㅠㅠ
put the ::1 in the address worked like a magic.
If you are not like ::1 like me, you can write that part in the address.
0: 0: 0: 0 Description- https://en.wikipedia.org/wiki/0.0.0.0
0: 0: 0: 0 It's a wildcard concept of IP. It is meant to mean all local IPv4 addresses.
Among the properties of the connector with protocol = "AJP", there are three properties that are closely related to this security issue: address, secret, secretRequired.
In the Tomcat 9 documentation,
Use of the AJP protocol requires additional security considerations because it allows greater direct manipulation of Tomcat's internal data structures than the HTTP connectors. Particular attention should be paid to the values used for the address, secret, secretRequired and allowedRequestAttributesPattern attributes.
It is written.
(In addition, the existing requiredSecret attribute, which functions as secretRequired, has been replaced by the secretRequired attribute.)
secret |
Only requests from workers with this secret keyword will be accepted. The default value is
null. This attrbute must be specified with a non-null, non-zero length value unless secretRequired is explicitly configured to be false. |
secretRequired |
If this attribute is
true, the AJP Connector will only start if the secret attribute is configured with a non-null, non-zero length value. The default value is true. |
(8 Tomcat seems not yet to be updated if the document)
Secret, try to stay updated not describe the properties secretRequired Tomcat When you start the server, the following error message is displayed.
The AJP Connector is configured with secretRequired = "true" but the secret attribute is either null or "". This combination is not valid.
This is the result of a new version, with the secretRequired attribute running by default by default, without setting the secret attribute (null by default).
And as I said earlier, the handling of Apache 2.4.42 and above is different. For Apache versions earlier than 2.4.42, the secret attribute is not defined, which causes problems that Apache cannot handle, even if you use secret in your Tomcat configuration.
Apache 2.4 Apache Module mod_proxy_ajp - https://httpd.apache.org/docs/2.4/mod/mod_proxy_ajp.html
Follow the link above to view the mod_proxy_ajp document.
| ? secret | 0x0C | String | Supported since 2.4.42 |
You will see
So if it's a later version
secret = "SECRET_VALUE" secretRequired = "true"
You can configure it this way,
More and less versions
secretRequired = "false"
You can configure it this way. For older versions, this is the only way.
I've tested it using the secret attribute and it says that I don't have access.
(It's likely a problem with the environment (Apache version), but I'm afraid there's something I need to set on the Apache side for that property, but none of the documents I found tells me.)
(It's likely a problem with the environment (Apache version), but I'm afraid there's something I need to set on the Apache side for that property, but none of the documents I found tells me.)
Now, when you're done editing server.xml, let's update Tomcat.
1.Tomcat directory backup.
2. sh bin / shutdown.sh
3. Replace with bin and lib updates
4. sh bin / startup.sh
If you have problems with user permissions in step 2 and 4, run
chmod 777 / bin -R
and try again. see.
Finally, let's check the version with sh version.sh.
Oh .. By the way, there was someone who wrote what I wanted right after I solved the problem. ㅠㅠ
It would have been nice to see this post first.
I seem to see a good bout've spent more concise writing.
Other Reference Links>
When troubleshooting these problems, the most important thing seems to be the log view.
(It was solved immediately after looking at the mod_jk log.)
I couldn't keep trying to update the operation, so it was just a waste to build a local environment.
Also, each case may have a different cause, so let's see the log first!
댓글 없음:
댓글 쓰기