YSoft SafeQ Security Note – Apache Tomcat AJP Vulnerability

March 31, 2020
YSoft SafeQ uses the third-party component, Apache Tomcat. A vulnerability of this component has been recently disclosed, known as CVE-2020-1938 (Ghostcat). The vulnerability is already fixed in new versions of Apache Tomcat (7, 9).

Affected components of YSoft SafeQ 6 are: 

    Management Server, MU 27 and lower 

    End User Interface, Build 42 and lower 

Affected components of YSoft SafeQ 5 

    Central Management Layer (CML) 
    Offline Remote Spooler (ORS). 

To immediately prevent a possible exploitation in a YSoft SafeQ production environment, administrators can select one of these options: 

    Disable the Apache JServ Protocol's (AJP) port in the Tomcat server configuration 
    In YSoft SafeQ 6 Build 28 and higher, stop End User Interface if this service is not in use in the company 
    Disable the 8009 and 9009 ports in a firewall setup 

See technical details below. 
 
The new version, Apache Tomcat 9.0.33, will be implemented in an upcoming YSoft SafeQ 6 Build 43 (April 2020) and higher. Additionally, the AJP ports 8009 and 9009 are not open in YSoft SafeQ 6 Build 43 and higher installations. When updating from Build 42 or lower, you may consider disabling the AJP as an additional security level. 
 
The Apache Tomcat server for the YSoft SafeQ Payment System never used AJP and the default configuration of this component has the port disabled. 
 
The same precautions apply to YSoft SafeQ 5 where the target is Maintenance Update 80. In this case, the product is using Apache Tomcat 7 which will be updated to version 7.0.100. 
 
How to disable the Apache JServ Protocol's (AJP) ports 

In all YSoft SafeQ 6 management servers: 

    Locate the file: <install_folder>\Management\tomcat\conf \server.xml 

    Delete the line: <Connector port="8009" protocol="AJP/1.3" redirectPort="443"/> 

    Restart the YSoft SafeQ Management Service 

In all YSoft SafeQ 6 site servers: 

    Locate the file: …<install_folder>\SPOC\EUI\conf\server.xml 

    Delete the line: <Connector port="9009" protocol="AJP/1.3" redirectPort="9443"/> 

    Restart the YSoft SafeQ End User Interface service 

In all YSoft SafeQ 5 CML and YSoft SafeQ 5 ORS servers: 

    Locate the file: <install_folder>\tomcat\conf\server.xml 

    Delete the line: <Connector port="8009" protocol="AJP/1.3" redirectPort="443"/> 

    Restart the YSoft SafeQ CML\ORS Service 

How to stop the YSoft SafeQ End User Interface service 

In all YSoft SafeQ 6 site servers: 

    Open the services window in the operating system which hosts YSoft SafeQ components 

    Search for the YSoft SafeQ End User Interface service and stop it 

    In the “Properties” menu, disable the service