[NEWS] WebSphere Widespread's JSP Configuration Disclosure

From: SecuriTeam (support_at_securiteam.com)
Date: 04/19/05

  • Next message: SecuriTeam: "[REVS] Introduction to HTTP Response Splitting" 
    To: list@securiteam.com
Date: 19 Apr 2005 14:57:17 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      WebSphere Widespread's JSP Configuration Disclosure
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www-306.ibm.com/software/websphere/> WebSphere is Internet
    infrastructure software - known as middleware. It enables companies to
    develop, deploy and integrate next-generation e-business applications,
    such as those for business-to-business e-commerce, and supports business
    applications from simple Web publishing through enterprise-scale
    transaction processing. WebSphere transforms the way businesses manage
    customer, partner, and employee relationships."

    IBM WebSphere discloses the JSP source when remote user requests non
    existing JSP page.

    DETAILS

    Vulnerable Systems:
     * IBM WebSphere Application version 6 and prior.

    The practice of sharing the document root of the application server within
    the document root of the web server creates a security exposure that can
    result in the JSP source being served up as plain text by the web server.

    The plug-in has a set of rules used to determine whether a given request
    will be handled by the application server. When an incoming request fails
    to match those rules, the plug-in returns control to the web server so
    that the web server can fulfill the request.

    In this case, the unknown host header causes the plug-in to return control
    to the web server because the rules don't indicate the application server
    should handle it. Therefore, the web server looks for the request in the
    web server document root. Since the JSP source is stored in the document
    root of the web server the web server finds the file and serves it as
    plain text. The following is a demonstration on how to replicate the
    issue.

    HTTP request sent:
    GET /index.jsp HTTP/1.0
    Host: NonExistentHost

    HTTP response received:
    HTTP/1.1 200 OK
    Via: HTTP/1.1 websphereserver (IBM-PROXY)
    Date: Wed, 09 Mar 2005 21:39:43 GMT
    Server: IBM_HTTP_Server/1.3.12.6 Apache/1.3.12 (Unix)
    Last-Modified: Tue, 01 Mar 2005 18:35:02 GMT
    ETag: "515e0007-1d72-4224b5d6"
    Accept-Ranges: bytes
    Content-Length: 7538
    Content-Type: text/plain
    <%@ include file="/main/inc/alt-header-0.inc" %>
    <%@ include file="includes/tabincv4.jsp" %>
    <%@ include file="includes/tactic.jsp" %>
    <%=headerjs%>
    <jsp:include page="<%=tabhdrinc %>" flush="true"/>

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:spilabs@spidynamics.com> SPI
    Labs.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[REVS] Introduction to HTTP Response Splitting"

    Relevant Pages

    • [NT] Xedus Webserver Directory Traversal and DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The Xedus web server is vulnerable to a directory traversal. ... this vulnerability constitutes a denial of ...
      (Securiteam)
    • [NEWS] SAP DB Web Server Stack Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SAP DB Web Server Stack Overflow ... By making the request again, but not including the Cookie Value, or if one ...
      (Securiteam)
    • [NT] Quick n Easy/Baby Web Server ASP Code Disclosure
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Quick 'n Easy/Baby Web Server ASP Code Disclosure ... Quick 'n Easy Web Server version 3.1.1 ... 22/03/2006 - Initial vendor notification ...
      (Securiteam)
    • [NEWS] IP Phones Based on PA168 Chipset Have Weak Session Management
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... IP Phones Based on PA168 Chipset Have Weak Session Management ... admin web console running as superuser. ... is for them to send a well-formed request to the web server. ...
      (Securiteam)
    • [EXPL] Baby Web Server Command Validation (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Server was to design a simple web server with support for ASP." ... By sending an especially crafted request to Baby Web Server, ...
      (Securiteam)
    • Quantcast