IBM AS/400 HTTP Server '/' Attack (Source Code Viewing)
16 Nov. 2001
Summary
IBM's HTTP Server on the AS/400 platform is vulnerable to an attack that will show the source code of the page - such as an .html or .jsp page -- by attaching an '/' to the end of a URL.
Example:
Comparing these two URL's:
http://www.example.com/getsource.jsp
http://www.foo.com/getsource.jsp/
The later URL will deliver the jsp source to the browser.
Since a .jsp page could contain user names and passwords if they are accessing databases, especially if these databases are on the network, this would be a serious security vulnerability.
