You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@felix.apache.org by "Konrad Windszus (Jira)" <ji...@apache.org> on 2026/08/03 15:39:00 UTC

[jira] [Commented] (FELIX-6854) AbstractServlet.spoolResource delivers arbitrary resources having prefix "/res/" visible to classloader

    [ https://issues.apache.org/jira/browse/FELIX-6854?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101421#comment-18101421 ] 

Konrad Windszus commented on FELIX-6854:
----------------------------------------

Seems that resource paths/names are not normalized (i.e. navigating to parent with {{../}} does not work). Therefore indeed only a question is prefix matching might lead to leakage of sensitive resources having a name starting with "res/".

> AbstractServlet.spoolResource delivers arbitrary resources having prefix "/res/" visible to classloader
> -------------------------------------------------------------------------------------------------------
>
>                 Key: FELIX-6854
>                 URL: https://issues.apache.org/jira/browse/FELIX-6854
>             Project: Felix
>          Issue Type: Bug
>          Components: Web Console
>    Affects Versions: webconsole-5.0.18
>            Reporter: Konrad Windszus
>            Priority: Major
>
> There is no limitation on resource names in https://github.com/apache/felix-dev/blob/762b769b60b41e139fce4a3c1b2c0bb1b2569155/webconsole/src/main/java/org/apache/felix/webconsole/servlet/AbstractServlet.java#L127 which allows to expose arbitrary class files via the Felix WebConsole. 
> Only the underlying bundle classloader may limit visibility.
> Although usually only admin like users have access to the Felix WebConsole, exposing all classloader resources unnecessarily may leak sensitive information.
> Would be best if each web console plugin maintains an allow list which resources may be requested but this would probably require a non backwards compatible fix.
> The same issue occurs in the deprecated AbstractWebConsolePlugin (https://github.com/apache/felix-dev/blob/762b769b60b41e139fce4a3c1b2c0bb1b2569155/webconsole/src/main/java/org/apache/felix/webconsole/AbstractWebConsolePlugin.java#L483).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)