Allaire JRun SSI Arbitrary File Source Disclosure Vulnerability
BID:3589
Info
Allaire JRun SSI Arbitrary File Source Disclosure Vulnerability
| Bugtraq ID: | 3589 |
| Class: | Design Error |
| CVE: |
CVE-2001-0926 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 28 2001 12:00AM |
| Updated: | Jul 11 2009 09:06AM |
| Credit: | Published in a Macromedia Product Security Bulletin (MPSB01-12) on Nov 27, 2001. |
| Vulnerable: |
Macromedia JRun 3.1 Macromedia JRun 3.0 Macromedia JRun 2.3.3 |
| Not Vulnerable: | |
Discussion
Allaire JRun SSI Arbitrary File Source Disclosure Vulnerability
Allaire JRun is a web application development suite with JSP and Java Servlets. JRun supports Server Side Includes (SSI), SSI allows a webmaster to include various files in an otherwise static HTML file. Variables which might be included could be the current time on a website or last modified date and time etc. By default, file extension associated to the SSI handler is .shtml.
JRun contains a vulnerability that allows a user to access the contents of files within the webroot. Submitting a specially crafted request for a non-existent .shtml file along with a known file, will reveal the contents of the known file residing on the host. This issue results because of a flaw in a Server Side component which handles requests for SSI pages. Files which are interpreted as executable content (JSP scripts) will have their possibly sensitive source code output if requested using this vulnerability.
It is also possible for attackers to execute arbitrary Java servlets, regardless of whether the mapping has been disabled.
JRun access controls set on files will not prevent their disclosure.
Allaire JRun is a web application development suite with JSP and Java Servlets. JRun supports Server Side Includes (SSI), SSI allows a webmaster to include various files in an otherwise static HTML file. Variables which might be included could be the current time on a website or last modified date and time etc. By default, file extension associated to the SSI handler is .shtml.
JRun contains a vulnerability that allows a user to access the contents of files within the webroot. Submitting a specially crafted request for a non-existent .shtml file along with a known file, will reveal the contents of the known file residing on the host. This issue results because of a flaw in a Server Side component which handles requests for SSI pages. Files which are interpreted as executable content (JSP scripts) will have their possibly sensitive source code output if requested using this vulnerability.
It is also possible for attackers to execute arbitrary Java servlets, regardless of whether the mapping has been disabled.
JRun access controls set on files will not prevent their disclosure.
Solution / Fix
Allaire JRun SSI Arbitrary File Source Disclosure Vulnerability