Apache JackRabbit 2.0.0 – webapp XPath Injection

• Exploit Database
• 41 阅读

• 作者： ADEO Security
  日期： 2010-08-11
• 类别：

  • webapps
  平台：

  • jsp
• 来源：https://www.exploit-db.com/exploits/14617/

• # Title: Apache JackRabbit webapp XPath Injection
  # Author: ADEO Security
  # Published: 11/08/2010
  # Version: 2.0.0 (Possible all versions)
  # Vendor: http://www.apache.org
  # Download: http://www.apache.org/dyn/closer.cgi/jackrabbit/2.0.0/jackrabbit-2.0.0-src.zip
  
  # Description: "Apache Jackrabbit is a fully conforming implementation
  of the Content Repository for Java Technology API (JCR, specified in
  JSR 170 and 283).
  A content repository is a hierarchical content store with support for
  structured and unstructured content, full text search, versioning,
  transactions, observation, and more.
  Apache Jackrabbit is a project of the Apache Software Foundation."
  
  # Credit: Vulnerability founded by Canberk BOLAT
  - Mail: canberk.bolat[AT]adeo.com.tr
  - Web: http://security.adeo.com.tr
  
  # Vulnerability:
  In search.jsp file HTTP GET parameter "q" included to XPath query
  without sanitised if its start with word "related:".
  
  search.jsp
  ...
  String q = request.getParameter("q");
  ...
   if (q != null && q.length() > 0) {
  String stmt;
  if (q.startsWith("related:")) {
  String path = q.substring("related:".length());
  stmt = "//element(*, nt:file)[rep:similar(jcr:content,
  '" + path + "/jcr:content')]/rep:excerpt(.) order by @jcr:score
  descending";
  queryTerms = "similar to <b>" +
  Text.encodeIllegalXMLCharacters(path) + "</b>";
  }
  ...