|
|
| |
| IBM's HTTP Server on the AS/400 platform is vulnerable to an attack that will show the source code of the page - such as an .html or .jsp page -- by attaching an '/' to the end of a URL. |
| |
Credit:
The information has been provided by 'ken' at FTU, Chris Best, and Joe Laffey.
|
| |
Vulnerable systems:
VSE-HTTPD/01.04.00
IBM-HTTP-Server/1.0
Example:
Comparing these two URL's:
http://www.example.com/getsource.jsp
http://www.foo.com/getsource.jsp/
The later URL will deliver the jsp source to the browser.
Since a .jsp page could contain user names and passwords if they are accessing databases, especially if these databases are on the network, this would be a serious security vulnerability.
|
|
|
|
|
|
|
|
