CVE-2020-1745: 
Java vulnerability analysis and mitigation

A file inclusion vulnerability (CVE-2020-1745) was discovered in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and earlier versions, which was fixed in version 2.0.30.Final. The vulnerability was reported to the Apache Software Foundation on January 3, 2020 (Red Hat Bugzilla).

The vulnerability exists in the AJP (Apache JServ Protocol) connector, which is enabled by default on port 8009. The CVSS v3.1 base score is 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability allows an unauthenticated remote attacker to read web application files from a vulnerable server through the AJP protocol functionality (NetApp Security, Tenable Blog).

A successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (NVD, NetApp Security).

The vulnerability can be exploited by a remote, unauthenticated attacker who can reach the AJP port directly. Several proof-of-concept exploit scripts have been made publicly available. The vulnerability is particularly dangerous because AJP is enabled by default and assumes that the network is safe (Tenable Blog).

If patching is not feasible, there are several mitigation options: 1) Disable AJP altogether if not in use by commenting it out from the configuration file, 2) Configure a secret password for the AJP conduit using the requiredSecret attribute, or 3) Ensure proper firewall rules are in place to restrict access to the AJP port. The recommended solution is to upgrade to Undertow version 2.0.30.Final or later (Red Hat Solution).

The vulnerability has received significant attention from the security community, with researchers confirming its potential for both file read and remote code execution capabilities. Security researchers from various organizations, including Alibaba Cloud and others, have publicly demonstrated and discussed the vulnerability's impact (Tenable Blog).