Tomcat 3.2.1 JSP Source Disclosure

[Robert Ellis <re...@first.gmd.de>]

I did the following while testing a JSP on tomcat 3.2.1 and received the
source for JSP instead of the proper output :

telnet xxx 8080
Trying xxx.xxx.xxx.xxx...
Connected to xxx.
Escape character is '^]'.
GET /test.jsp
HTTP/1.0 200 OK
Content-Type: text/plain
Content-Length: 40
Last-Modified: Tue, 19 Dec 2000 11:08:39 GMT
Servlet-Engine: Tomcat Web Server/3.2.1 (JSP 1.1; Servlet 2.2; Java
1.3.0; SunOS 5.5.1 sparc; java.vendor=Sun Microsystems Inc.)
 
<%
out.println("hello i'm a jsp :)");
%>Connection closed by foreign host.


This only seems to happen if you leave out the http version number in
the request.
Tomcat-4.0-m5 doesn't seem to do this.

Thanks for a great free (as in speech and beer) piece of software

Cheers
Robert

[PATCH] SECURITY FIX (Re: Tomcat 3.2.1 JSP Source Disclosure)

[Kazuhiro Kazama <ka...@ingrid.org>]

This patch fixes Tomcat 3.2.1 security problem that Yoshiyuki Karezaki
(cf. BugRat Report #513) and Robert Ellis (cf. "Tomcat 3.2.1 JSP
Source Disclosure") reported.

At the same time, this patch fixes the bug Mark Brouwer reported
 (cf. "[BUG] getProtocol() method on ServletRequest includes CRLF
causing problems").

Kazuhiro Kazama (kazama@ingrid.org)	NTT Network Innovation Laboratories

--- src/org/apache/tomcat/service/http/HttpRequestAdapter.java.orig	Wed Dec 13 06:37:14 2000
+++ src/org/apache/tomcat/service/http/HttpRequestAdapter.java	Wed Dec 20 15:54:56 2000
@@ -303,7 +303,9 @@
     private  final int skipSpaces() {
 	while (off < count) {
 	    if ((buf[off] != (byte) ' ') 
-		&& (buf[off] != (byte) '\t')) {
+		&& (buf[off] != (byte) '\t')
+		&& (buf[off] != (byte) '\r')
+		&& (buf[off] != (byte) '\n')) {
 		return off;
 	    }
 	    off++;
@@ -316,7 +318,9 @@
     private  int findSpace() {
 	while (off < count) {
 	    if ((buf[off] == (byte) ' ') 
-		|| (buf[off] == (byte) '\t')) {
+		|| (buf[off] == (byte) '\t')
+		|| (buf[off] == (byte) '\r')
+		|| (buf[off] == (byte) '\n')) {
 		return off;
 	    }
 	    off++;
@@ -369,9 +373,8 @@
 	
 	method= new String( buf, startMethod, endMethod - startMethod );
 
-	if( endReq < 0 ) {
+	if( startProto < 0 ) {
 	    protocol=null;
-	    endReq=count;
 	} else {
 	    if( endProto < 0 ) endProto = count;
 	    protocol=new String( buf, startProto, endProto-startProto );

Re: Tomcat 3.2.1 JSP Source Disclosure

[Kazuhiro Kazama <ka...@ingrid.org>]

Robert

This bug is already reported as BugRat Report #513 by Mr. Karezaki, too.

From: Robert Ellis <re...@first.gmd.de>
Subject: Tomcat 3.2.1 JSP Source Disclosure
Date: Tue, 19 Dec 2000 13:15:18 +0100
Message-ID: <3A...@first.gmd.de>
> This only seems to happen if you leave out the http version number in
> the request.

That's right. A good workaround may be using mod_jk.

Kazuhiro Kazama (kazama@ingrid.org)		NTT Network Innovation Laboratories