Apache Tomcat AJP Connector File Read and Remote Code Execution Vulnerability (Ghostcat, CVE-2020-1938)
Executive & SecOps Summary
SECOPS ASSESSMENTApache Tomcat versions 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99
Attackers with access to the AJP port (default 8009) can read arbitrary files from the web application or execute arbitrary code (RCE) if file upload is permitted
Upgrade to Apache Tomcat 9.0.31, 8.5.51, 7.0.100 or later, or disable/restrict the AJP Connector in the configuration
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrading to a secure version (9.0.31, 8.5.51, 7.0.100 or later) is highly recommended as it hardens the default AJP configuration.
# Upgrade Tomcat on Debian/Ubuntu systems
sudo apt-get update
sudo apt-get --only-upgrade install tomcat9 tomcat9-admin -y
# Upgrade Tomcat on RedHat/CentOS systems
sudo yum update tomcat -y2. Temporary Workaround & Hardening Configuration
If upgrading immediately is not feasible, edit the conf/server.xml file to disable the AJP connector or restrict it to the loopback address with a strong secret.
<!-- Option 1: Disable AJP completely by commenting it out (Recommended if not used) -->
<!--
<Connector protocol='AJP/1.3'
address='0.0.0.0'
port='8009'
redirectPort='8443' />
-->
<!-- Option 2: If AJP is required, bind to localhost and enforce authentication -->
<Connector protocol='AJP/1.3'
address='127.0.0.1'
port='8009'
redirectPort='8443'
secretRequired='true'
secret='YOUR_STRONG_AJP_SECRET_KEY' />3. Log Audit & IoC Verification Commands
Use the following commands to check if your system is listening on the vulnerable AJP port and to verify the running Tomcat version.
# 1. Check if port 8009 is listening on public interfaces
netstat -antp | grep 8009
# 2. Verify the running Tomcat version
if [ -n '$CATALINA_HOME' ]; then
$CATALINA_HOME/bin/version.sh | grep 'Server version'
else
ps -ef | grep tomcat
fiBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability, widely known as 'Ghostcat', stems from a design and implementation flaw in the Apache JServ Protocol (AJP) connector of Apache Tomcat. Tomcat treats AJP connections with a higher level of trust than standard HTTP connections. By default, Tomcat shipped with the AJP Connector enabled and listening on all configured IP addresses (0.0.0.0:8009). An attacker capable of reaching this port can exploit the protocol's attributes to manipulate request attributes and force the server to read or process arbitrary files within the web application.
2. Exploitation Mechanics & Attack Scenario
The AJP protocol is a binary protocol designed to proxy requests from a front-end web server to a back-end Tomcat instance. By crafting a custom AJP request, an attacker can inject specific servlet attributes, namely javax.servlet.include.request_uri, javax.servlet.include.path_info, and javax.servlet.include.servlet_path.
- Local File Inclusion (LFI): The attacker can force the Tomcat server to return the contents of any file within the web application context (e.g.,
WEB-INF/web.xml, configuration files containing credentials). - Remote Code Execution (RCE): If the target application allows users to upload files (even non-executable formats like
.txtor.png) and stores them within the web application directory, the attacker can use the AJP connector to force Tomcat to process the uploaded file as a JSP, leading to arbitrary code execution.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. If the AJP port is exposed to the public internet, automated scanners and malicious actors can easily extract sensitive source code and database credentials. Successful exploitation leading to RCE allows complete system compromise, potentially serving as an entry point for ransomware deployment or lateral movement within the internal network.
Official Vendor Advisories & References
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
Frequently Asked SecOps Questions (CVE-2020-1938)
FAQQ1. How critical is CVE-2020-1938 and is it actively exploited in the wild?
CVE-2020-1938 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-1938?
Primary impacted vendors include apache across tomcat. Scope summary: Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99
Q3. What temporary mitigations or workarounds exist for CVE-2020-1938 before patching?
[Mitigation] Upgrade to Apache Tomcat 9.0.31, 8.5.51, 7.0.100 or later, or disable/restrict the AJP Connector in the configuration Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-1938
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.