# Vulnerability Discovery

> Ghostcat file read via AJP and exposed Manager discovery

- **URL:** https://hackindex.io/services/tomcat-ajp/vulnerability-discovery
- **Service:** [Tomcat / AJP](https://hackindex.io/services/tomcat-ajp.md)
- **Published:** 2026-03-30
- **Updated:** 2026-03-30

Tomcat AJP vulnerability discovery determines whether the AJP connector is exploitable. The primary finding is an exposed AJP connector on port 8009 without the secret attribute. Any Tomcat version before 9.0.31, 8.5.51, or 7.0.100 that has AJP enabled (it is enabled by default) is vulnerable to Ghostcat unless the connector has been explicitly secured.

Test for Ghostcat by attempting to read a known file like /WEB-INF/web.xml through the AJP connector. If the file contents come back, the server is confirmed vulnerable. Check the Tomcat version from HTTP error pages or Server headers on the HTTP connector, then cross-reference against patched versions.

Default credentials on the Tomcat Manager and Host Manager applications (tomcat/tomcat, admin/s3cret, manager/manager) are a separate finding that enables WAR deployment for RCE. Verify whether these interfaces are accessible through AJP even if they are restricted on the HTTP connector. An unsecured AJP connector combined with a deployed Manager application is a direct path to code execution.

## Guides

- [Ghostcat — Tomcat AJP File Read (CVE-2020-1938)](https://hackindex.io/services/tomcat-ajp/vulnerability-discovery/ghostcat-ajp-file-read.md)
- [Tomcat Manager Exposed](https://hackindex.io/services/tomcat-ajp/vulnerability-discovery/tomcat-manager-exposed.md): Identify exposed Tomcat Manager interfaces, enumerate credentials via default/brute-force attacks, and leverage access for WAR-based RCE deployment.