Subject: IBM WebSphere Widespread configuration JSP disclosure
Date: Wed, 13 Apr 2005 15:57:47 -0400
Message-ID: <F71BB5B89FB0384290F8085CFB84061E8057EE@mcbain.spidynamics.com.>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: IBM WebSphere Widespread configuration JSP disclosure
Thread-Index: AcVAYxC5XHyYRjj9RgmZqY1mqh6NnQ==
From: "SPI Labs" <spilabs@spidynamics.com.>
Sender: "Sacha Faust" <sfaust@spidynamics.com.>
To: <pen-test@securityfocus.com.>, <bugtraq@securityfocus.com.>,
<vuln-dev@securityfocus.com.>, <full-disclosure@lists.grok.org.uk.>,
<webappsec@securityfocus.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
IBM WebSphere Widespread configuration JSP disclosure
Release Date: 04/13/2005
Severity: High
[Systems Affected]
* IBM WebSphere Application 6 and prior.
[Description]
The practice of sharing the document root of the app server within the
document
root of the web server creates a security exposure that can result in
the jsp source being served up as plain text by the web server. The
plug-in has a set of rules used to determine whether a given request
will be handled by the app server. When an incoming request fails to
match those rules, the plug-in returns control to the web server so that
the web server can fulfill the request. In this case, the unknown host
header causes the plug-in to return control to the web server because
the rules don't indicate the app server should handle it. Therefore, the
web server looks for the request in the web server document root. Since
the jsp source is stored in the document root of the web server the web
server finds the file and serves it as plain text. The following is a
demonstration on how to replicate the issue.
HTTP request sent
GET /index.jsp HTTP/1.0
Host: NonExistentHost
HTTP response received
HTTP/1.1 200 OK
Via: HTTP/1.1 websphereserver (IBM-PROXY)
Date: Wed, 09 Mar 2005 21:39:43 GMT
Server: IBM_HTTP_Server/1.3.12.6 Apache/1.3.12 (Unix)
Last-Modified: Tue, 01 Mar 2005 18:35:02 GMT
ETag: "515e0007-1d72-4224b5d6"
Accept-Ranges: bytes
Content-Length: 7538
Content-Type: text/plain
<%@ include file=3D"/main/inc/alt-header-0.inc" %>
<%@ include file=3D"includes/tabincv4.jsp" %>
<%@ include file=3D"includes/tactic.jsp" %>
<%=3Dheaderjs%>
<jsp:include page=3D"<%=3Dtabhdrinc %>" flush=3D"true"/>
[Remediation]
To eliminate this exposure, you should move the app server jsp source
outside of the web server document root. Then, when this request comes
in with the unknown host header the plug-in will return control to the
web server and the web server will fail to find the file in the document
root. Therefore, the web server will return 404 File Not Found rather
than the jsp source.
[Vendor Information]
The vendor was contacted repeatedly without any conclusive results.
Contact Information
[email protected]
SPI Dynamics, Inc.
115 Perimeter Center Place N.E.
suite 1100
Atlanta, GA. 30346
Toll-Free Phone: (866) 774-2700
SPI Dynamics was founded in 2000 by a team of accomplished Web security
specialists; SPI Dynamics is the leader in Web application security
technology. With such signature products as WebInspect, SPI Dynamics is
dedicated to protecting companies' most valuable assets. SPI Dynamics
has created a new breed of Internet security products for the Web
application, the most vulnerable yet least secure component of online
business infrastructure.
Copyright (c) 2005 SPI Dynamics, Inc. All rights reserved worldwide.
