full-disclosure - IBM WebSphere Widespread configuration JSP disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <F71BB5B89FB0384290F8085CFB84061E8057EE@mcbain.spidynamics.com>
Date: Wed Apr 13 20:58:49 2005
From: spilabs at spidynamics.com (SPI Labs)
Subject: IBM WebSphere Widespread configuration JSP
	disclosure

IBM WebSphere Widespread configuration JSP disclosure

Release Date:	04/13/2005
Severity:	High

[Systems Affected]
*	IBM WebSphere Application 6 and prior.

[Description]

The practice of sharing the document root of the app server within the
document
root of the web server creates a security exposure that can result in
the jsp source being served up as plain text by the web server. The
plug-in has a set of rules used to determine whether a given request
will be handled by the app server. When an incoming request fails to
match those rules, the plug-in returns control to the web server so that
the web server can fulfill the request. In this case, the unknown host
header causes the plug-in to return control to the web server because
the rules don't indicate the app server should handle it. Therefore, the
web server looks for the request in the web server document root. Since
the jsp source is stored in the document root of the web server the web
server finds the file and serves it as plain text. The following is a
demonstration on how to replicate the issue.

HTTP request sent
-----------------

GET /index.jsp  HTTP/1.0
Host: NonExistentHost

HTTP response received
----------------------

HTTP/1.1 200 OK
Via: HTTP/1.1 websphereserver (IBM-PROXY)
Date: Wed, 09 Mar 2005 21:39:43 GMT
Server: IBM_HTTP_Server/1.3.12.6 Apache/1.3.12 (Unix)
Last-Modified: Tue, 01 Mar 2005 18:35:02 GMT
ETag: "515e0007-1d72-4224b5d6"
Accept-Ranges: bytes
Content-Length: 7538
Content-Type: text/plain

<%@ include file="/main/inc/alt-header-0.inc" %>
<%@ include file="includes/tabincv4.jsp" %>
<%@ include file="includes/tactic.jsp" %>
<%=headerjs%>
<jsp:include page="<%=tabhdrinc %>" flush="true"/>

[Remediation]

To eliminate this exposure, you should move the app server jsp source
outside of the web server document root. Then, when this request comes
in with the unknown host header the plug-in will return control to the
web server and the web server will fail to find the file in the document
root. Therefore, the web server will return 404 File Not Found rather
than the jsp source.

[Vendor Information]
The vendor was contacted repeatedly without any conclusive results.

Contact Information
spilabs@...dynamics.com
SPI Dynamics, Inc.
115 Perimeter Center Place N.E.
suite 1100
Atlanta, GA. 30346
Toll-Free Phone: (866) 774-2700

SPI Dynamics was founded in 2000 by a team of accomplished Web security
specialists; SPI Dynamics is the leader in Web application security
technology. With such signature products as WebInspect, SPI Dynamics is
dedicated to protecting companies' most valuable assets. SPI Dynamics
has created a new breed of Internet security products for the Web
application, the most vulnerable yet least secure component of online
business infrastructure.

Copyright (c) 2005 SPI Dynamics, Inc. All rights reserved worldwide.