{"id":756201,"date":"2020-03-03T22:33:12","date_gmt":"2020-03-04T06:33:12","guid":{"rendered":"https:\/\/www.esri.com\/arcgis-blog\/?post_type=blog&p=756201"},"modified":"2022-02-16T10:46:07","modified_gmt":"2022-02-16T18:46:07","slug":"dont-get-bitten-by-ghostcat-tomcat-vulnerability","status":"publish","type":"blog","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/arcgis-online\/administration\/dont-get-bitten-by-ghostcat-tomcat-vulnerability","title":{"rendered":"Don\u2019t Get Bitten by GhostCat Tomcat Vulnerability"},"author":3911,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","meta":{"_acf_changed":false,"_searchwp_excluded":""},"categories":[37501],"tags":[24081,24071],"industry":[],"product":[36571,36551,763582],"class_list":["post-756201","blog","type-blog","status-publish","format-standard","hentry","category-administration","tag-ssamymlgp","tag-security","product-arcgis-enterprise","product-arcgis-online","product-trust-arcgis"],"acf":{"short_description":"Critical vulnerability in Tomcat could affect your ArcGIS deployment","flexible_content":[{"acf_fc_layout":"content","content":"

If you deploy Apache\u2019s Tomcat separately to support your ArcGIS platform deployment, please take two minutes to read this summary concerning a critical vulnerability spanning 13 years of Tomcat versions using the default install.\u00a0 While Esri embeds Tomcat within some of its products, we disable the Apache JServ Protocol (AJP) connector, so deploying our products does not expose you to the GhostCat vulnerability.<\/p>\n

If our products are not vulnerable, why provide an announcement?\u00a0 First, the GhostCat vulnerability (CVE-2020-1938) is in the media and customers want to know if their ArcGIS deployment is vulnerable.\u00a0 Secondly, some customers choose to deploy Apache Tomcat separately with our products, such as in conjunction with the ArcGIS Java Web Adaptor, or together with Apache as a reverse proxy. \u00a0If your organization utilizes either of these configurations, we strongly recommend you validate if the AJP connector is enabled (the default vulnerable Tomcat configuration).<\/p>\n

Verification<\/strong>: You can validate if the AJP connector is disabled for your Tomcat deployment by opening the <Tomcat>\/conf\/server.xml file and seeing if the connector has been commented out similar to the below:<\/p>\n

<!\u2013 <Connector port = “8009” protocol = “AJP \/ 1.x” redirectPort = “8443” \/>\u00a0\u2013><\/p>\n

Mitigation<\/strong>: If the Tomcat AJP connector is not disabled, and you are utilizing our Web Adaptor<\/a>, feel free to comment out the connector to disable it right away.\u00a0 Of course, even better would be to upgrade to the latest version of Tomcat which fixes the vulnerability and switches to disabling AJP by default.\u00a0 Note that JBoss is also affected, but is significantly less common.<\/p>\n

This issue serves as a great reminder of the importance of security hardening your deployment, we include some tools<\/a> to help with this when using our products, but ensure you also harden additional 3rd<\/sup> party components you add.\u00a0 A brief write-up concerning hardening Tomcat 8 is here<\/a> \u2013 notice the final step \u2013 minimize connectors \u2013 for most customers that will be done by disabling AJP\u2026<\/p>\n

Additional info about GhostCat may be found here<\/a>.\u00a0 We will update this article if\/as necessary.<\/p>\n

 <\/p>\n