Skip to content

Latest commit

 

History

History
72 lines (59 loc) · 6.42 KB

threat-modeling.md

File metadata and controls

72 lines (59 loc) · 6.42 KB

Threat Model Analysis for apache/tomcat

Threat: Default Administrator Credentials

  • Description: An attacker attempts to log in to Tomcat's administrative interfaces (Manager, Host Manager) using default usernames (e.g., tomcat, admin) and passwords. They might use automated scripts or manual brute-force attempts. This is a direct consequence of not securing Tomcat's initial setup.
  • Impact: Full server compromise, unauthorized deployment of malicious applications, data breaches, service disruption.
  • Affected Tomcat Component: Manager and Host Manager web applications, Authentication Realms.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Change default usernames and passwords for all administrative users immediately after installation.
    • Implement strong password policies.
    • Consider disabling or restricting access to administrative interfaces from public networks.
    • Enable account lockout policies to prevent brute-force attacks.

Threat: Example Applications and Default Web Applications Vulnerabilities

  • Description: Attackers target known vulnerabilities in Tomcat's example web applications (e.g., examples, docs) or default management applications (Manager, Host Manager) if they are left deployed in production. These are applications shipped with Tomcat and are part of its distribution.
  • Impact: Remote code execution, unauthorized access, information disclosure, denial of service.
  • Affected Tomcat Component: Example Web Applications, Manager and Host Manager web applications.
  • Risk Severity: High
  • Mitigation Strategies:
    • Remove example web applications and default web applications (Manager, Host Manager) from production deployments.
    • If management applications are needed, restrict access based on IP address or network segment.
    • Regularly update Tomcat to the latest version to patch known vulnerabilities in these applications.

Threat: Exploiting Known Tomcat Vulnerabilities

  • Description: Attackers scan for and exploit publicly disclosed vulnerabilities in specific Tomcat versions. They use exploit code or tools targeting known weaknesses in Tomcat's core components. This directly targets the Tomcat server software itself.
  • Impact: Remote code execution, denial of service, information disclosure, unauthorized access, full server compromise.
  • Affected Tomcat Component: Core Servlet Container, JSP Engine, Connectors, Management Applications, potentially other modules depending on the vulnerability.
  • Risk Severity: Critical to High (depending on the vulnerability)
  • Mitigation Strategies:
    • Keep Tomcat updated to the latest stable version and apply security patches promptly.
    • Subscribe to security mailing lists and monitor vulnerability databases for Tomcat advisories.
    • Use a vulnerability scanner to identify outdated Tomcat versions and potential vulnerabilities.

Threat: Unauthorized Access to Tomcat Manager/Host Manager

  • Description: Attackers attempt to gain unauthorized access to the Tomcat Manager or Host Manager applications through weak authentication, session hijacking, or exploiting vulnerabilities in these applications themselves. These are core Tomcat management applications.
  • Impact: Full server compromise, malicious application deployment, service disruption, data breaches.
  • Affected Tomcat Component: Manager and Host Manager web applications, Authentication Realms, Session Management (within Tomcat).
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Enforce strong authentication for Manager and Host Manager (e.g., strong passwords, client certificates).
    • Restrict access to these applications based on IP address or network segment.
    • Regularly audit user access and roles for these applications.
    • Disable or remove these applications if not strictly necessary.

Threat: AJP 'Ghostcat' Vulnerability (CVE-2020-1938)

  • Description: Attackers exploit the AJP 'Ghostcat' vulnerability by sending specially crafted AJP requests to Tomcat's AJP connector. This allows them to bypass authentication and read arbitrary files or potentially execute code. This is a vulnerability within Tomcat's AJP connector implementation.
  • Impact: Remote file inclusion, remote code execution, unauthorized access to sensitive files, server compromise.
  • Affected Tomcat Component: AJP Connector.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Disable the AJP connector if it is not required.
    • If AJP is necessary, ensure it is only accessible from trusted sources (e.g., reverse proxy on the same server).
    • Upgrade to a patched version of Tomcat that addresses the 'Ghostcat' vulnerability.
    • Configure requiredSecret attribute for the AJP connector for authentication (though this is not a complete mitigation and upgrading is recommended).

Threat: Weak Authentication Realms

  • Description: Attackers compromise weak authentication mechanisms configured in Tomcat realms (e.g., basic authentication over HTTP, easily cracked password files). This allows them to bypass authentication and access protected resources managed by Tomcat's realm configuration.
  • Impact: Unauthorized access to applications and server resources, data breaches.
  • Affected Tomcat Component: Authentication Realms (e.g., UserDatabaseRealm, JDBCRealm), Security Constraints (configured in web.xml or Tomcat context files).
  • Risk Severity: High
  • Mitigation Strategies:
    • Use strong authentication mechanisms (e.g., form-based authentication with strong passwords, client certificates, integration with enterprise identity providers).
    • Always use HTTPS (TLS/SSL) to protect credentials in transit, especially with basic authentication.
    • Avoid storing passwords in plain text or easily reversible formats within Tomcat realm configurations.
    • Implement multi-factor authentication (MFA) for sensitive applications if supported by the authentication mechanism integrated with Tomcat.