Tomcat Connector Architecture

Apache Tomcat utilizes two primary connectors for handling requests:

<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443" />

<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />

The HTTP Connector processes standard web browser requests, while the AJP Connector communicates with web containers using the binary AJP protocol, typically when integrating Tomcat with Apache HTTP Server. AJP offers improved efficiency and performence over HTTP's text-based protocol.

Servlet Handling Mechanism

Tomcat employs servlets to process network requests through a defined lifecycle managed by the container. Two default servlets are configured in conf/web.xml:

<servlet>
    <servlet-name>default</servlet-name>
    <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
</servlet>

<servlet>
    <servlet-name>jsp</servlet-name>
    <servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
</servlet>

<servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

<servlet-mapping>
    <servlet-name>jsp</servlet-name>
    <url-pattern>*.jsp</url-pattern>
    <url-pattern>*.jspx</url-pattern>
</servlet-mapping>

JSP request are handled by JspServlet, while all other requests are processed by DefaultServlet.

Fille Read Vulnerability Analysis

When a request doesn't match any servlet mapping, it routes to DefaultServlet. The vulnerability exists in the serveResource() method where three critical parameters control resource path resolution:

javax.servlet.include.request_uri
javax.servlet.include.servlet_path  
javax.servlet.include.path_info

By manipulating these parameters through crafted AJP requests, attackers can bypass path normalization checks and read arbitrary files within the webapps directory. The normalize() method performs security checks but only prevents directory traversal beyond webapps root.

Arbitrary Code Execution Vulnerability

This secondary vulnerability requires an attacker to first upload a malicious file, then use the file read vulnerability to trigger JSP processing of the uploaded file. When JspServlet processes a request, it compiles the target file into Java bytecode and executes it as a servlet.

The execution flow involves:

1. Request reaches JspServlet via crafted AJP parameters
2. jspUri is constructed from servlet_path and path_info
3. JspServletWrapper processes the URI and compiles the file
4. Compiled servlet gets executed through the service method