Apache Http Server Reveals Script Source Code to Remote Users And [Archief]

Wang Yun

09/02/04, 21:35

TOPIC:
======
Apache + Resin Reveals JSP Source Code to Remote Users And Any Users Can Access Resin Forbidden Directory ("/WEB-INF/")

Description:
============
Security vulnerability has been found in Windows NT/2000 Systems that have Apache 1.3.29 + Resin 2.1.12 installed. The vulnerability allows remote users view script Source Code And Access files in the Forbidden Directory.

Exploits:
=========
http://apache/index.jsp%20
It is possible to cause the Apache server to send back the content of index.jsp.

http://apache/WEB-INF../
It is possible to cause the Apache server to send back the list of "/WEB-INF/" Directory.

Analyze:
========
1.Apache think "/WEB-INF../" unequal to "/WEB-INF/" So find this Directory by itself.
2."/WEB-INF/" Directory not Forbidden in Apache Config files.
3."d:\resin\doc\>cd WEB-INF.." legit in Windows Systems.

Sorry for my poor english.

lovehacker
China

CHINESE:
========
在Windows上安装Apache 和 Resin来支持JSP或者Servlet存在两个问题。首先可能会导致泄露JSP文&#2021
4;的源代码,同时还可能允许用户穿过“WEB-INF”目录访问Servlet及JavaBean。暴露JSP文件源代码&
#30340;具体方法是在JSP文件后跟随“%20”也就是UNICODE编码后的空格，而访问 “WEB-INF”目录下文
件的具体方法是在“WEB-INF”后加两个或者更多的“.”。

入侵者结合以上两个问题可以轻松的获得数据库密码等重要信息，首先&#21033
;用“%20”获得JSP文件的源代码，根据源代码了解到JAVABEAN的文件名称，例如通过<%@ page impor
t="com.my.db.Database"%>我们就可以知道JAVABEAN的名称为：“Database.class”，而它所在的目录是： “/WEB-INF/CLASSES/COM/MY/DB/”&#
12290;然后我们再利用第二种方法对其进行访问即可获得该文件，进&#3
4892;JAVA反编译后我们就可以看到其中的重要信息了。

为什么会出现这样的问题呢？其实和我发现的第一个APACHE漏洞（利用%5c访问WEB&#3
0446;录外文件）类似，都是由于APACHE是在UNIX下开发后移植到WINDOWS上来的，*NI X不支持"cd /
usr.."，而在Windows下却是支持的。当用户请求“/WEB-INF../”时APACHE并不认为应该将它交给RESIN处&#
29702;，而是自己找这个目录，由于WINDOWS支持在目录名后加“.”所以APACHE成功&#3
0340;找到了它，同时由于在APACHE的配置中并没有要禁止对该目录下的文件进行&#3
5775;问，所以APACHE读出了文件的内容。

小弟不材，如果有不正确的地方万望指出，祝大家2004多多发财！

lovehacker

17/02/04, 20:05

I don't acknowledge this.

I tested this with Windows XPsp1 running IE 6.0.2800 with latest
patches. Running on the latest build of Apache server on the same box.

IE knew the difference between 'web-inf..' And 'web-inf.' and
'web-inf...' (so did apache). Matter of a fact creating separate pages
with these names resulted in separate loading.

Perhaps your 'claim' can be further substatiated by what 'you' are doing
to IE to cause this.

J.

:> -----Original Message-----
:> From: Alun Jones [mailto:alun@texis.com]
:> Sent: Thursday, February 12, 2004 5:32 PM
:> To: 'Peter J. Holzer'; bugtraq@securityfocus.com
:> Subject: RE: Apache Http Server Reveals Script Source Code
:> to Remote Users And Any Users Can Access The Forbidden
:> Directory ("/WEB-INF/")
:>
:>
:> > -----Original Message-----
:> > From: Peter J. Holzer [mailto:hjp@wsr.ac.at]
:> > Sent: Wednesday, February 11, 2004 6:50 AM
:> >
:> > Right. On Unix "WEB-INF" and "WEB-INF.." are two
:> different, legal file
:> > names. On Windows, trailing dots seem to be ignored, so
:> "WEB-INF" and
:> > "WEB-INF.." are just two names for the same file. This
:> also works if
:> > the filename already has an extension, so for example
:> "foo.html" and
:> > "foo.html....." are the same file, too. I wonder whether
:> that can be
:> > exploited, too: Get the contents of a CGI script by requesting
:> > "foo.cgi."?
:>
:> It's been done before - certainly in IIS, there was a bug
:> where getting a "filename.asp." URL gave you the source of
:> the ASP script. Same for "filename.asp:$DATA".
:>
:> Alun.
:> ~~~~
:> --
:> Texas Imperial Software | Find us at http://www.wftpd.com or email
:> 1602 Harvest Moon Place | alun@texis.com.
:> Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP
:> servers. Fax/Voice +1(512)258-9858 | Try our NEW client
:> software, WFTPD Explorer.
:>
:>