JSFTemplating Mojarra Scales and GlassFish Application Server File Disclosure Vulnerability
1 Sep. 2009
Summary
The JSFTemplating FileStreamer functionality is vulnerable to file disclosure and also allows an attacker to retrieve directory listings of the whole server. Furthermore Mojarra Scales and the GlassFish Application Server Admin console are using vulnerable components too.
Vulnerable Systems:
* JSFTemplating prior to version 1.2.11
* Mojarra Scales prior to version 1.3.2
* GlassFish v3 Preview (Admin console)
Immune Systems:
* JSFTemplating version 1.2.11
* Mojarra Scales version 1.3.2
* GlassFish v2
JSFTemplating/FileStreamer can be exploited to read sensitive application data on the whole server depending on the configuration. One tested server allowed us to access all files on the server (with rights of the webserver user), another server was restricted to files within the webroot (but including WEB-INF) - it might depend on the Java Security Model or filesystem rights.
An attacker is able to gain sensitive data such as configuration files (WEB-INF/web.xml), the whole source code of the application or other sensitive data on the server.
Furthermore it is possible to retrieve directory listings of directories on the whole server and the webroot by specifying a directory instead of a file.
Proof of Concept:
The URLs to exploit this vulnerability may differ from server to server. The vulnerable HTTP parameters are usually named "filename" or "file". By specifying the following URLs an attacker gains access to sensitive configuration files, source code or other possibly sensitive files:
By using an empty value for the file/filename parameter, a directory listing of the webroot is being shown. Directory traversal is also possible but it depends on the installation/configuration whether it is possible to access data outside the webroot.
Disclosure Timeline:
2009-07-07: Contacted the developers
2009-08-31: Fixes for JSFTemplating and Mojarra Scales available
2009-09-01: Coordinated release date
-------------------------------------------------------------------------------------------------------------------------------
Find out more about website security scanning.
-
