COMMAND
ServletExec
SYSTEMS AFFECTED
RESIN ServletExec
PROBLEM
'benjurry' found following. Resintm serves the fastest servlets
and JSP. With Java and JavaScript support, Resin gives web
applications the flexibility to choose the right language for the
task. Resin's leading XSL (XML stylesheet language) support
encourages separation of content from formatting. Resin provides
a fast servlet runner for Apache, allowing Apache to run servlets
and JSP files.
But On Resin1.2(maybe Resin1.1 also) with Win32(Win2k Simplify
Chinese version)Apache, ServletExec will return the source code
of JSP files when a HTTP request is appended with one of the
following characters:
".."
"%2e.."
"%81"
"%82"
........
"%fe"
For example, the following URL will display the source of the
specified JSP file:
http://benjurry/benjurry.jsp..
http://benjurry/benjurry.jsp%81
Successful exploitation could lead to the disclosure of sensitive
information contained within JSP pages.
David Cruz tested that on his developing platform. It's not
working with Apache 1.3.9, Resin1.1.5, it's not working with
resin1.2.0 too. All this in Solaris. Guess it's another win2K
bug only.
SOLUTION
Nothing yet.