|
Brought to you by:
Suppliers of:
|
|
|
| |
| A request that includes a specially crafted request parameter could be used to access content that would otherwise be protected by a security constraint or by locating it in under the WEB-INF directory. |
| |
Credit:
The information has been provided by Iida Minehiko.
|
| |
Vulnerable Systems:
* Apache Tomcat version 4.1.0 to 4.1.39
*Apache Tomcat version 5.5.0 to 5.5.27
*Apache Tomcat version 6.0.0 to 6.0.18
Immune Systems:
* Apache Tomcat version 4.1.40 and later
*Apache Tomcat version 5.5.28 and later
*Apache Tomcat version 6.0.20 and later
When using a RequestDispatcher obtained from the Request, the target path was normalised before the query string was removed.
Example:
For a page that contains:
<%
request.getRequestDispatcher( "bar.jsp?somepar=someval&par=" +
request.getParameter( "blah" ) ).forward( request, response ); %>
an attacker can use:
http://host/page.jsp?blah=/../WEB-INF/web.xml
Patch Availability:
http://svn.apache.org/viewvc?view=rev&revision=734734
http://svn.apache.org/viewvc?view=rev&revision=782757
http://svn.apache.org/viewvc?view=rev&revision=782763
CVE Information:
CVE-2008-5515
|
|
|
|
|
