SID 1:53341

Rule Category

SERVER-APACHE -- Snort has detected traffic exploiting vulnerabilities in Apache servers.

Alert Message

SERVER-APACHE Apache Tomcat AJP connector arbitrary file access attempt

Rule Explanation

The Snort rule is looking for accessing of files on webroot of tomcat server via AJP connector that is running on TCP/8009

What To Look For

When attacker tries to access arbitrary file on the tomcat server via AJP connector

Known Usage

Public information/Proof of Concept available

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

CVE-2020-1938

Rule Vulnerability

Information Leak

Information Leakage happens when an attacker manipulates a system into revealing sensitive information, either through malformed input or by taking advantage of another feature of the system.

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.

CVE-2020-1938

Loading description

MITRE ATT&CK Framework

Tactic: Exfiltration

Technique: Exfiltration Over Alternative Protocol

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org