You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jspwiki.apache.org by "Harry Metske (JIRA)" <ji...@apache.org> on 2008/08/23 18:55:44 UTC
[jira] Updated: (JSPWIKI-315) Attachment upload allows .jsp files
[ https://issues.apache.org/jira/browse/JSPWIKI-315?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Harry Metske updated JSPWIKI-315:
---------------------------------
Security: (was: Security Vulnerability Disclosure)
> Attachment upload allows .jsp files
> -----------------------------------
>
> Key: JSPWIKI-315
> URL: https://issues.apache.org/jira/browse/JSPWIKI-315
> Project: JSPWiki
> Issue Type: Bug
> Components: Core & storage
> Affects Versions: 2.7.x
> Environment: All
> Reporter: Andrew Jaquith
> Fix For: 2.6.4, 2.8
>
>
> http://marc.info/?l=bugtraq&m=120300554011544&w=2
> As described in the vulnerability disclosure. An uploaded file attachment, if a JSP, will execute when viewed. Steps to reproduce:
> 1. Create a JSP called Foo.jsp with these contents: URI: <%=request.getRequestURI()%>
> 2. Navigate to page Main and upload this attachment/
> 3. Supplying the URL http://localhost:8080/JSPWiki/Foo.jsp will execute the JSP and display the URI.
> However, uploading a file that contains JSP content, but does NOT have the .jsp suffix seems fine. E.g., http://localhost:8080/JSPWiki/Bar (no extension) does cause the contents of Bar to be compiled and executed.
> Recommendation: any files with .jsp extension should be forcibly stripped out from the file, or else simply rejected.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.