Apache + Resin Reveals JSP Source Code to Remote Users And Any Users Can Access Resin Forbidden Directory ("/WEB-INF/")
Description:
============
Security vulnerability has been found in Windows NT/2000 Systems that have Apache 1.3.29 + Resin 2.1.12 installed. The vulnerability allows remote users view script Source Code And Access files in the Forbidden Directory.
Exploits:
=========
http://apache/index.jsp%20
It is possible to cause the Apache server to send back the content of index.jsp.
http://apache/WEB-INF../
It is possible to cause the Apache server to send back the list of "/WEB-INF/" Directory.
Analyze:
========
1.Apache think "/WEB-INF../" unequal to "/WEB-INF/" So find this Directory by itself.
2."/WEB-INF/" Directory not Forbidden in Apache Config files.
3."d:\resin\doc\>cd WEB-INF.." legit in Windows Systems.
TOPIC:
======
Apache + Resin Reveals JSP Source Code to Remote Users And Any Users Can Access Resin Forbidden Directory ("/WEB-INF/")
Description:
============
Security vulnerability has been found in Windows NT/2000 Systems that have Apache 1.3.29 + Resin 2.1.12 installed. The vulnerability allows remote users view script Source Code And Access files in the Forbidden Directory.
Exploits:
=========
http://apache/index.jsp%20
It is possible to cause the Apache server to send back the content of index.jsp.
http://apache/WEB-INF../
It is possible to cause the Apache server to send back the list of "/WEB-INF/" Directory.
Analyze:
========
1.Apache think "/WEB-INF../" unequal to "/WEB-INF/" So find this Directory by itself.
2."/WEB-INF/" Directory not Forbidden in Apache Config files.
3."d:\resin\doc\>cd WEB-INF.." legit in Windows Systems.
Sorry for my poor english.
lovehacker
China
CHINESE:
========
在Windows上安装Apache 和 Resin来支持JSP或者Servlet存在&
#20004;个问题。首先可能&
#20250;导致泄露JSP文件的
4;代码,同时还可能允ť
68;用户穿过?WEB-INF?目录访&
382;Servlet及JavaBean。暴露JSP文件&#
28304;代码的具体方法是&#
22312;JSP文件后跟随?%20?也就&#
26159;UNICODE编码后的空格，
2780;访问?WEB-INF?目录下文件&#
30340;具体方法是在?WEB-INF?后&
#21152;两个或者更多的?.?Ӎ
0;
入侵者结合以上两个
问题可以轻松的获得
数据库密码等重要信
息，首先利用?%20?获得JSP
文件的源代码，根据
源代码了解到JAVABEAN的文
件名称，例如通过<%@ page import="com.my.db.Database"%>我们就可以
0693;道JAVABEAN的名称为：?Database.c
lass?，而它所在的目录
6159;：?/WEB-INF/CLASSES/COM/MY/DB/?。然后ৎ
5;们再利用第二种方ૢ
1;对其进行访问即可ഫ
9;得该文件，进
4892;JAVA反编译后我们就可
;以看到其中的重要信
;息了。
为什么会出现这样的
问题呢？其实和我发
现的第一个APACHE漏洞（&#
21033;用%5c访问WEB目录外文
214;）类似，都是由于APAC
HE是在UNIX下开发后移植&#
21040;WINDOWS上来的，*NIX不支持
;"cd /usr.."，而在Windows下却是支&#
25345;的。当用户请求?/WEB-INF.
./?时APACHE并不认为应该将
;它交给RESIN处理，而是&#
33258;己找这个目录，由&#
20110;WINDOWS支持在目录名后
1152;?.?所以APACHE成功
0340;找到了它，同时由
0110;在APACHE的配置中并没ć
77;要禁止对该目录下į
40;文件进行访问，所É
97;APACHE读出了文件的内容
;。
小弟不材，如果有不
正确的地方万望指出
，祝大家2004多多发财A
281;
lovehacker
[ reply ]