• Platformchevron right
  • Solutionschevron right
  • Modern NDRchevron right
  • Resourceschevron right
  • Companychevron right

DETECTION OVERVIEW

Apache Tomcat JSP Exploit Attempt - [Multiple CVEs]

Risk Factors

Apache Tomcat vulnerabilities are well known and an unauthenticated attacker can easily access servers exposed to the internet. An attacker can steal sensitive information, gain control of a device, or launch additional attacks on the network.

Kill Chain

Exploitation

Risk Score

83

Detection diagram
Next in Exploitation: Atlassian Bitbucket Server and Data Center Exploit - CVE-2022-36804

Attack Background

Apache Tomcat is an open-source implementation of a Java servlet container for hosting web applications. Tomcat enables Java code to run on a server. Vulnerabilities in Tomcat enable an attacker to upload a malicious Java Server Page (JSP) file with a script or command-line tool through a modified URL. The attacker runs the script by calling the URL of the malicious JSP file. Depending on the sophistication of the payload containing the code, the attacker might be able to exfiltrate data or leverage a web shell to run commands on the server.

Mitigation Options

Install patches for relevant versions, or make the following configuration changes:

Configure default settings in conf/web.xml to disable the HTTP PUT method

Configure the default servlet contexts in conf/web.xml to the value of readonly=true

Enforce authentication roles in conf/web.xml by enabling the security constraint setting, <auth-constraint>

Confirm that application-level settings in WEB-INF/web.xml do not override default Tomcat configurations

MITRE ATT&CK ID

What else can RevealX do for you?