You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-dev@axis.apache.org by "Wolfram Kluge (JIRA)" <ji...@apache.org> on 2009/03/21 01:52:50 UTC
[jira] Created: (AXIS2-4279) Local File Inclusion Vulnerability on
parsing WSDL related XYD Files
Local File Inclusion Vulnerability on parsing WSDL related XYD Files
--------------------------------------------------------------------
Key: AXIS2-4279
URL: https://issues.apache.org/jira/browse/AXIS2-4279
Project: Axis 2.0 (Axis2)
Issue Type: Bug
Environment: Tomcat 5.5
Axis2 1.4.1
Reporter: Wolfram Kluge
Hello
i dont know if it is a vulnerability or it is an issue of missconfiguration.
The problem occur by doing the following things,
http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
i was able to get these files displayed by the web browser. Once i tried this,
furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
If its a bug please let me also know!
Thank you in advance!
Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (AXIS2-4279) Local File Inclusion Vulnerability on
parsing WSDL related XYD Files
Posted by "Andreas Veithen (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Andreas Veithen updated AXIS2-4279:
-----------------------------------
Component/s: transports
Priority: Blocker (was: Major)
Affects Version/s: 1.4.1
Fix Version/s: 1.5
I tested this with a recent snapshot distribution and I can confirm this issue. This is a serious problem that absolutely needs to be fixed for 1.5, especially now that the vulnerability is publicly known.
> Local File Inclusion Vulnerability on parsing WSDL related XYD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Issue Comment Edited: (AXIS2-4279) Local File Inclusion
Vulnerability on parsing WSDL related XYD Files
Posted by "Jarek Gawor (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12688150#action_12688150 ]
Jarek Gawor edited comment on AXIS2-4279 at 3/22/09 9:54 AM:
-------------------------------------------------------------
Ok, thanks. I can replicate now with 1.4.1. In 1.4.1 you can access any file within webapps/axis2 directory but in trunk or branches/2.1 you can access any file on the file system (on Windows).
was (Author: gawor@mcs.anl.gov):
Ok, thanks. I can replicate now with 1.4.1. In 1.4.1 you can access any file within webapps/axis2 directory but in trunk or branches/2.1 you can access any file on the file system.
> Local File Inclusion Vulnerability on parsing WSDL related XYD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Issue Comment Edited: (AXIS2-4279) Local File Inclusion
Vulnerability on parsing WSDL related XYD Files
Posted by "Jarek Gawor (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12688150#action_12688150 ]
Jarek Gawor edited comment on AXIS2-4279 at 3/22/09 8:43 PM:
-------------------------------------------------------------
Ok, thanks. I can replicate now with 1.4.1. In 1.4.1 you can access any file within webapps/axis2 directory but in trunk or branches/java/1_5 you can access any file on the file system (on Windows).
was (Author: gawor@mcs.anl.gov):
Ok, thanks. I can replicate now with 1.4.1. In 1.4.1 you can access any file within webapps/axis2 directory but in trunk or branches/2.1 you can access any file on the file system (on Windows).
> Local File Inclusion Vulnerability on parsing WSDL related XYD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XSD Files
Posted by "Amila Chinthaka Suriarachchi (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12695498#action_12695498 ]
Amila Chinthaka Suriarachchi commented on AXIS2-4279:
-----------------------------------------------------
Is this occur in linux as well?
According to the given description the isn't following url should show the axis2.xml?
http://localhost:8085/axis2/services/Version?xsd=/../../../WEB-INF/conf/axis2.xml
Can't we fix this issue by checking for "../" in the query?
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XSD Files
Posted by "Boris Milanov (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12688291#action_12688291 ]
Boris Milanov commented on AXIS2-4279:
--------------------------------------
Hi,
The same issue appears if your execute a wsdl2 query: ...?wsdl2=/../../../WEB-INF/conf/axis2.xml
Regards,
Boris
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XSD Files
Posted by "Jarek Gawor (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12689596#action_12689596 ]
Jarek Gawor commented on AXIS2-4279:
------------------------------------
Detelin,
I don't. I think we should restrict what types of files can be served using ?xsd or ?wsdl2. And we can't also allow any files to be served from within the META-INF. That's a classloader lookup so technically anything within META-INF anywhere in the classloader could be served, so we need to restrict it somehow. I chose to restrict it based on the file extension.
Item 2 you mentioned is already how things work for ?xsd. That is, it looks for schemas in a map first (this map is based on the service referenced wsdl/schema files) but if it fails it falls back to this classloader lookup. That's why my initial reaction was to remove this fallback code but at the end I decided to keep and patch it, in case somebody is actually relying on that. I figured it was added for a reason.
The ?wsdl2 also has this classloader lookup but it's the only means of getting named wsdl2 files. So we would need a new solution for that if we were to remove the classloader lookup code.
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XSD Files
Posted by "Amila Chinthaka Suriarachchi (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12695671#action_12695671 ]
Amila Chinthaka Suriarachchi commented on AXIS2-4279:
-----------------------------------------------------
Although I could not get the axis2.xml this worked for me
http://localhost:8085/axis2/services/Version?xsd=services.xml
Again people can write security polices in service.xml (for new SMTP transport SMTP passwords are put into
services.xml file)
I think it is possible to get password call back class as well.
So as Jarek has mentioned we must restrict it for known extension types.
Only option to support other extension is to put a parameter to axis2.xml and set it default only to xsd and wsdl. So that users can add
any other type if they think safe.
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XSD Files
Posted by "Glen Daniels (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12744096#action_12744096 ]
Glen Daniels commented on AXIS2-4279:
-------------------------------------
Isn't this already resolved in 1.5? I don't have time to test this right now, but will later.
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: nightly
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XYD Files
Posted by "Jarek Gawor (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12688205#action_12688205 ]
Jarek Gawor commented on AXIS2-4279:
------------------------------------
I fixed the problem in trunk and branches/java/1_5 that allowed access to any files on the file system (see AXIS2-4282). So, now trunk and branches/java/1_5 behaves and has same problem as in Axis2 1.4.1.
> Local File Inclusion Vulnerability on parsing WSDL related XYD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XYD Files
Posted by "Wolfram Kluge (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12688120#action_12688120 ]
Wolfram Kluge commented on AXIS2-4279:
--------------------------------------
Well, sorry for less description.
Environment:
OS: Windows XP SP3
JAVA: v1.6
Server: Tomcat 5.5
Axis2: WAR-File Distribution
My steps to reproduce this issue.
Tomcat was downloaded and installled on a windows system. Since the server started successfull we put the WAR file
in webapps dir. Till now connecting to axis2 interface was possible. Furthermore we setup Eclipse and build a simple
Web Service containig nothing more then one class without any content. We build the web service within the IDE and exported it as WAR. Next we deployed our useless web service in same procedure as the axis2 war file.
Since we got the wsdl oft the web service displayed we tried to execute attack vector shown above. I cant believe that these issue is allready know because there are so many servers out there which vulnerable against these vector.
Is there a CVE-ID in place?
> Local File Inclusion Vulnerability on parsing WSDL related XYD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (AXIS2-4279) Local File Inclusion Vulnerability on
parsing WSDL related XSD Files
Posted by "Deepal Jayasinghe (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Deepal Jayasinghe updated AXIS2-4279:
-------------------------------------
Fix Version/s: (was: 1.5)
nightly
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: nightly
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XSD Files
Posted by "Andreas Veithen (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12689546#action_12689546 ]
Andreas Veithen commented on AXIS2-4279:
----------------------------------------
Detelin,
Your item 2 describes exactly how this is actually supposed to work. The problem is that there is some sort of fallback code that calls getResourceAsStream with a resource name directly taken from the query parameter. I guess this was initially introduced as a hack to solve AXIS2-1556 (even though this actually no longer works). In my opinion the code relying on getResourceAsStream should be removed entirely, but it is a bit difficult to assess the impact of this.
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XSD Files
Posted by "Jarek Gawor (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12688862#action_12688862 ]
Jarek Gawor commented on AXIS2-4279:
------------------------------------
I committed a basic fix for this security problem (revision 758006). Please review and/or suggest better solutions.
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (AXIS2-4279) Local File Inclusion Vulnerability on
parsing WSDL related XSD Files
Posted by "Wolfram Kluge (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Wolfram Kluge updated AXIS2-4279:
---------------------------------
Summary: Local File Inclusion Vulnerability on parsing WSDL related XSD Files (was: Local File Inclusion Vulnerability on parsing WSDL related XYD Files)
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XYD Files
Posted by "Andreas Veithen (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12688125#action_12688125 ]
Andreas Veithen commented on AXIS2-4279:
----------------------------------------
I think that the root cause of this problem is a change in r470928 [1] that passes the value of the xsd parameter directly to getResourceAsStream. This is of course not good, because it allows anybody to read any resource. The change was done just before the 1.1 release and was related to AXIS2-1556. Note that in the meantime the code has been moved to AxisService#printXSD.
[1] http://svn.apache.org/viewvc/webservices/axis2/branches/java/1_1/modules/kernel/src/org/apache/axis2/transport/http/ListingAgent.java?r1=453185&r2=470928&pathrev=470928
> Local File Inclusion Vulnerability on parsing WSDL related XYD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XSD Files
Posted by "Stoil Valchkov (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12717961#action_12717961 ]
Stoil Valchkov commented on AXIS2-4279:
---------------------------------------
I've just seen that fix version is changed to "nightly" from 1.5. Does it mean that released 1.5 is not fixed?
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: nightly
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (AXIS2-4279) Local File Inclusion Vulnerability on
parsing WSDL related XSD Files
Posted by "Amila Chinthaka Suriarachchi (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Amila Chinthaka Suriarachchi resolved AXIS2-4279.
-------------------------------------------------
Resolution: Fixed
fixed in the current trunk
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis2
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: nightly
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XYD Files
Posted by "Jarek Gawor (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12688150#action_12688150 ]
Jarek Gawor commented on AXIS2-4279:
------------------------------------
Ok, thanks. I can replicate now with 1.4.1. In 1.4.1 you can access any file within webapps/axis2 directory but in trunk or branches/2.1 you can access any file on the file system.
> Local File Inclusion Vulnerability on parsing WSDL related XYD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XYD Files
Posted by "Jarek Gawor (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12688100#action_12688100 ]
Jarek Gawor commented on AXIS2-4279:
------------------------------------
I see this problem in trunk and branches/1_5 but not with 1.4.1. Wolfram, can you explain in more detail your setup (OS, web container, etc.)?
> Local File Inclusion Vulnerability on parsing WSDL related XYD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (AXIS2-4279) Local File Inclusion Vulnerability
on parsing WSDL related XSD Files
Posted by "Detelin Yordanov (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12689538#action_12689538 ]
Detelin Yordanov commented on AXIS2-4279:
-----------------------------------------
Hi guys,
Don't you think that checking for .xsd extension is a way too restrictive? It is perfectly possible that there are services out there, which import schemas with different file extension (e.g. simply .xml). I would suggest the following restrictions to apply:
1. Allow access only to files under META-INF
2. Allow access only to imported schemas/wsdls, for this to work one just needs to verify whether the file to load is imported from any of the AxisService schemas, or is contained in AxisService's importedNamespaces (contains WSDL Imports).
What do you think?
Regards,
Detelin
> Local File Inclusion Vulnerability on parsing WSDL related XSD Files
> --------------------------------------------------------------------
>
> Key: AXIS2-4279
> URL: https://issues.apache.org/jira/browse/AXIS2-4279
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: transports
> Affects Versions: 1.4.1
> Environment: Tomcat 5.5
> Axis2 1.4.1
> Reporter: Wolfram Kluge
> Priority: Blocker
> Fix For: 1.5
>
>
> Hello
> i dont know if it is a vulnerability or it is an issue of missconfiguration.
> The problem occur by doing the following things,
> http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml
> i was able to get these files displayed by the web browser. Once i tried this,
> furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.
> So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
> If its a bug please let me also know!
> Thank you in advance!
> Wolfram
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.