# MA-775.032020: MyCERT Alert - Ghostcat - Apache Tomcat AJP File Read/Inclusion Vulnerability

**Date:** 02 Mar 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-775.032020  
**Advisory ID:** MA-775.032020

---

**1.0 Introduction**
Recently, a vulnerability has been identified in Apache Tomcat. This vulnerability was specifically found in Tomcat Apache JServ Protocol that leverages its functionality to gain access to read or write files at the Tomcat server. Tomcat AJP is a binary protocol that can proxy inbound request from server through web application that holds place behind the server.
**2.0 Impact**
This vulnerability could allow attacker to modify files and upload malicious JavaServer Page (JSP) content to gain remote code execution (RCE) to the Tomcat server.
**3.0 Affected System and Devices**
- Apache Tomcat 9.x < 9.0.31
- Apache Tomcat 8.x < 8.5.51
- Apache Tomcat 7.x < 7.0.100
- Apache Tomcat 6.x
**4.0 Recommendations**
Users and administrator are highly recommended to do necessary updates from origin resource:
- Tomcat 9.0.31 - <https://tomcat.apache.org/download-90.cgi>
- Tomcat 8.5.51 - <https://tomcat.apache.org/download-80.cgi>
- Tomcat 7.0.100 - <https://tomcat.apache.org/download-70.cgi>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.chaitin.cn/en/ghostcat>
- <https://github.com/Neo23x0/signature-base/blob/master/yara/vul_cve_2020_1938.yar>
- <https://github.com/DaemonShao/CVE-2020-1938>
- <http://tomcat.apache.org/>
- <https://www.reddit.com/r/netsec/comments/fbf63w/cve20201938_ghostcat_aka_tomcat_9876_in_the/?utm_campaign=192478&utm_medium=twitter&utm_source=twitter>