You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2016/03/29 09:35:12 UTC
[Bug 59243] New: Path traversal Attack
https://bz.apache.org/bugzilla/show_bug.cgi?id=59243
Bug ID: 59243
Summary: Path traversal Attack
Product: Tomcat 7
Version: 7.0.67
Hardware: PC
OS: Mac OS X 10.1
Status: NEW
Severity: normal
Priority: P2
Component: Servlet & JSP API
Assignee: dev@tomcat.apache.org
Reporter: muthukumar13402040@gmail.com
RequestDispatcher.forward() method allows to access /WEB-INF folder. This is an
issue ??
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59243] Path traversal Attack
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59243
--- Comment #7 from Mark Thomas <ma...@apache.org> ---
Bugzilla is not a support forum. Your questions belong on the users mailing
list.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59243] Path traversal Attack
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59243
--- Comment #3 from muthukumar <mu...@gmail.com> ---
Think my scenario . It is possible to make path traversal attack . It must be a
security issue?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59243] Path traversal Attack
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59243
Violeta Georgieva <vi...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |INVALID
--- Comment #4 from Violeta Georgieva <vi...@apache.org> ---
(In reply to muthukumar from comment #2)
> the param for RequestDispatcher is coming from url parameter .
Fix you application.
Regards,
Violeta
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59243] Path traversal Attack
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59243
--- Comment #5 from Christopher Schultz <ch...@christopherschultz.net> ---
(In reply to Violeta Georgieva from comment #4)
> Fix your application.
Correct. The path-traversal vulnerability has been introduced by your own
application, not by Tomcat.
One of the best ways to prevent this kind of thing is to white-list certain
paths that are acceptable (and won't ever cause a path-traversal issue).
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59243] Path traversal Attack
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59243
muthukumar <mu...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INVALID |---
--- Comment #2 from muthukumar <mu...@gmail.com> ---
I used RequestDispatcher in my app and the param for RequestDispatcher is
coming from url parameter . If an attacker changes this parameter value to
"/WEB-INF/web.xml" he can access my secret files . Do you proper solution???
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59243] Path traversal Attack
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59243
--- Comment #6 from muthukumar <mu...@gmail.com> ---
Ok We whitelisted that paths.. But we want a proper solution . Whitelisted is a
proper solution ? Please explain me the CVE 2008-5515
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59243] Path traversal Attack
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59243
Violeta Georgieva <vi...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |INVALID
--- Comment #1 from Violeta Georgieva <vi...@apache.org> ---
Hi,
Why do you think so?
In the spec it is stated
"
10.5 Directory Structure
...However, the contents of the WEB-INF directory are visible to servlet code
using the getResource and getResourceAsStream method calls on the
ServletContext, and may be exposed using the RequestDispatcher calls..."
Regards,
Violeta
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org