Home / server / Questions / 1005548
Accepted
egmontr
Asked: 2020-03-05 04:19:47 +0800 CST

Getting error 403 with Tomcat 7.0.100 and Apache server 2.4 when using "secret" with AJP

  • 772

Because of the bug CVE-2020-1938 we want to use the latest Tomcat 7.0.100. See also CVE-2020-1938 We also use an Apache server in version 2.4, which connects to the Tomcat via AJP.

The latest Tomcat version requires various new settings for secure communication, which we have made. Unfortunately we always get the HTTP error 403 and don't know why.

In the Apache workers.properties we have the following settings:

worker.list=okkommwm57f
ps=\
worker.okkommwm57f.type=ajp13
worker.okkommwm57f.host=192.168.181.240
worker.okkommwm57f.secret=123456
worker.okkommwm57f.port=8309
worker.okkommwm57f.socket_keepalive=1
worker.okkommwm57f.connect_timeout=10000  
worker.okkommwm57f.prepost_timeout=10000
worker.okkommwm57f.socket_timeout=10
worker.okkommwm57f.connection_pool_timeout=600

The AJP connector configuration looks like this:

<Connector port="8309" protocol="AJP/1.3" redirectPort="8443" secretRequired="true" secret="123456" address="192.168.181.240" />

When I test the site, I keep getting the HTTP error 403. I have tried different versions, but to no avail. Have already set "secretRequired" to "false". Does not work too.

Maybe someone has an idea and can help me to solve the problem. Thank you.

ajp apache-2.4 tomcat7

2 Answers

  1. Best Answer

    I had the same issue.

    I had to add allowedRequestAttributesPattern=".*" to the connector

    So in your case 

    <Connector port="8309" protocol="AJP/1.3" redirectPort="8443" secretRequired="true" secret="123456" address="192.168.181.240" allowedRequestAttributesPattern=".*" />

    This is a new attribute which has been added with Tomcat 7.0.100.

    Add a new attribute, allowedRequestAttributesPattern to the AJP/1.3 Connector. Requests with unrecognised attributes will be blocked with a 403. (markt)

    Although I haven't figured out what attribute we are sending. But if the setting works for you with a wildcard, you are probably sending attributes as part of your AJP request which are not recognized.

    • 6

  2. I had the same issue. The trick was to set a password. So the following solved the issue for us:

    server.xml:

    <Connector port="8109" protocol="AJP/1.3" redirectPort="8443" secret="verysecure" secretRequired="true"/>

    worker.properties:

    worker.tomcat-06.secret=verysecure
    • 2