[VulnWatch] wp-02-0011: Jetty CGIServlet Arbitrary Command Execution

From: Matt Moore (matt@westpoint.ltd.uk)
Date: 10/02/02 

Date: Wed, 02 Oct 2002 16:58:41 +0100
From: Matt Moore <matt@westpoint.ltd.uk>
To: bugtraq@securityfocus.com, vulnwatch@vulnwatch.org

Westpoint Security Advisory

Title: Jetty CGIServlet Arbitrary Command Execution
Risk Rating: Medium
Software: Jetty Servlet Container
Platforms: Win32 (other platforms not tested)
Vendor URL: www.mortbay.org
Author: Matt Moore <matt@westpoint.ltd.uk>
Date: 1st October 2002
Advisory ID#: wp-02-0011.txt

Overview:
=========
Jetty is a 100% Java HTTP Server and Servlet Container. A flaw
in the CGIServlet allows an attacker to execute arbitrary commands
on the server.

Details:
========

Commands can be executed on the server by making requests like:

http://jetty-server:8080/cgi-bin/..\..\..\..\..\..\winnt/notepad.exe

Patch / Workaround Information:
===============================

The vendor responded quickly and has released a fixed version, 4.1.0
which can be downloaded from http://jetty.mortbay.org

Excerpt from Vendor announcement at:

http://groups.yahoo.com/group/jetty-announce/message/45

'4.1.0 also contains a priority security fix for the CGI servlet
running on windows platforms. This remotely exploitable problem
effects all previous versions of Jetty that use the CGI servlet
on windows without a permissions file configured for the context.
The CGI servlet from 4.1.0 may be used in 4.0 releases.'

This advisory is available online at:

http://www.westpoint.ltd.uk/advisories/wp-02-0011.txt

Relevant Pages

  • wp-02-0011: Jetty CGIServlet Arbitrary Command Execution
    ... Platforms: ... Jetty is a 100% Java HTTP Server and Servlet Container. ... The vendor responded quickly and has released a fixed version, ...
    (Bugtraq)
  • Re: java se + servlet
    ... Usually not in a desktop application but we have deployed many servlet based systems using only Java SE and an embedded servlet container (we use Jetty). ... We have all the applications listen on different ports and run a reverse proxy in front of them to publish the applications via port 80 but with different URLs ...
    (comp.lang.java.programmer)
  • Re: HttpServletResponse doesnt set the header
    ... If I am right the resp header is set by jetty after your servlet has ... So i dont think it will be available to you in the context ... of the execution of the servlet. ...
    (comp.lang.java)
  • Re: Itext Servlet =?ISO-8859-1?Q?l=E4uft_nicht?=
    ... Ich kenne mich mit der Config deines Server nicht aus, nutze nur Tomcat und Jetty, aber wo ist der Unterschied zwischen kind="lib" und kind="output"? ... Und davon mal abgesehen wundert mich ... ein simples Servlet zu testen bringt dich IMHO nicht weiter. ... Wenn ich mich nicht verguckt habe, dann nutzt du in deinem selbst geschriebenen Servlet itext gar nicht. ...
    (de.comp.lang.java)