Bug Report #649

[Tomoaki Okitsu <ok...@ma.kcom.ne.jp>]

hi

please see #649

http://tomcat.3.2.1/examples/jsp/num/numguess.jsp%20

PATCH: JSP Source Disclosure Vulnerability (Re: Bug Report #649)

[Kazuhiro Kazama <ka...@ingrid.org>]

From: kazama@ingrid.org (Kazuhiro Kazama)
Subject: Re: Bug Report #649
Date: Fri, 22 Dec 2000 11:43:01 +0900
Message-ID: <20...@ingrid.org>
> This bug may be system dependent. Would you describe your OS and its
> release?

I analyzed this problem in cooperation with JavaHouse-Brewers mailing
list (Java technical discussions in Japan) and found there are two
bugs.

These bugs resembles ServletExec JSP source disclosure vulnerability
(http://www.securityfocus.com/bid/1970) in situation.

1, When you adds "%20" (in fact, URL encoded character or its
sequences from %01 to %20) to an URL's end, Tomcat returns a JSP
source code instead of its result.

When you uses mod_jk and delegates all HTTP requests under the
directory specified by a "JkMount" directive to Tomcat, this bug comes
out.

Example:
	http://localhost/examples/jsp/num/numguess.jsp%20
  
Workaround:
Apply an atached patch to your Tomcat 3.2.1. This patch removes extra
trim() which is remove U+0000 - U+0020 characters from an URL.

2, When you adds '.' or "%2E" (= '.') to an URL's end, Apache server
(not Tomcat) returns a JSP source code of JSP files.

This is a Windows bug and I confirmed it on Windows 98 and Windows
2000. But a security measure is needed to Apache server.

When you uses mod_jk on Windows and JSP files is accessible from your
apache server by adding an "Alias" directive, This bug comes out.

Example:
	http://localhost/examples/jsp/num/numguess.jsp.
	http://localhost/examples/jsp/num/numguess.jsp%2E

Workaround:
On Windows platform, don't use "Alias" directive for mounting your Web
application directory. Tomcat generates "mod_jk.conf-auto" has "Alias"
directives so that you should fix it on Windows.

This bug may be correctable but I have no time to fix Apache server. I
hope someone will inform better solution.

By the way, these bugs don't happen on Tomcat & mod_jserv. But I don't
think that it is a good idea to use a mod_jserv module on Tomcat 3.2.1
because this behavior may depend anothor mod_jserv bugs.

Kazuhiro Kazama (kazama@ingrid.org)		NTT Network Innovation Laboratories

Re: Bug Report #649

[Kazuhiro Kazama <ka...@ingrid.org>]

Tomoaki

From: Tomoaki Okitsu <ok...@ma.kcom.ne.jp>
Subject: Bug Report #649
Date: Fri, 22 Dec 2000 10:32:32 +0900
Message-ID: <20...@ma.kcom.ne.jp>
> http://tomcat.3.2.1/examples/jsp/num/numguess.jsp%20

I test this url. But I get "404 Not Found" and don't see a JSP source
code.

This bug may be system dependent. Would you describe your OS and its
release?

Anyway, this bug's cause is the almost same as BugRat Report #513. If
a filename has trailers which is constructed by space characters (CR,
LF, SPACE etc.), Tomcat misinterprets its MIME-type and return its
source code in text/plain format.

Kazuhiro Kazama (kazama@ingrid.org)		NTT Network Innovation Laboratories