Sun's Java Web Server Remote Command Execution on Admin Server

[Foundstone Labs <labs () FOUNDSTONE COM>]

                            Foundstone, Inc.
                        http://www.foundstone.com
                      "Securing the Dot Com World"

                           Security Advisory

    Sun's Java Web Server Remote Command Execution on Admin Server

----------------------------------------------------------------------
FS Advisory ID:         FS-082200-11-JWS

Release Date:           August 22, 2000

Product:                Java Web Server

Vendor:                 Sun Microsystems (http://www.sun.com)

Type:                   Remote command execution

Severity:               High

Author:                 Saumil Shah (saumil.shah () foundstone com)
                        Shreeraj Shah (shreeraj.shah () foundstone com)
                        Stuart McClure (stuart.mcclure () foundstone com)
                        Foundstone, Inc. (http://www.foundstone.com)

Operating Systems:      Solaris and Windows NT

Vulnerable versions:    Sun Java Web Server, all versions

Foundstone Advisory:    http://www.foundstone.com
----------------------------------------------------------------------

Description

        Using Sun's Java Web Server's administration module
        configuration and the Bulletin Board example application
        supplied with Java Web Server, it is possible to remotely
        execute arbitrary commands on the target system despite
        existing vendor recommendations for hardening.

        NOTE: Foundstone and Sun recommends implementing
        vendor recommended hardening steps as those found in Sun's
        advisory http://www.sun.com/software/jwebserver/faq/
        jwsca-2000-02.html on locking down Java Web Server. However,
        you must implement the solutions below to address the issues
        discussed in this advisory.

Details

        The com.sun.server.http.pagecompile.jsp92.JspServlet servlet
        is also known to compile JSP pages (if they are not already
        compiled) and execute them within the Java Runtime Enviroment
        and hand the output back to the web server.

        Sun's Java Web Server FAQ (mentioned above) eliminated forced
        invocation of servlets using the /servlet/ prefix for the Java
        Web Server Web Service and Secure Web Service. However, it is
        possible to use the administration module, which runs on port
        9090 by default and invoke servlets using the /servlet/ prefix
        in the URL and point it to any arbitrary file within the
        administration document root on the web server to be compiled
        and executed as if it were a JSP file. With carefully crafted
        JSP tags, it is possible to execute arbitrary commands on the
        server.

        Java Web Server comes with a sample bulletin board application
        that creates a "board.html" file in the web document root
        directory, that stores messages posted to the bulletin board
        by remote users. The bulletin board application can be
        accessed via the administration module by:

        http://jws.site:9090/examples/applications/bboard/
                                                    bboard_frames.html

        There is a user input text area for posting comments on the
        bulletin board. The code to be uploaded needs to be entered
        here, and uploaded into "board.html" by clicking the Post To
        Board button.

        If JSP code has been posted to "board.html", it is possible to
        get the code compiled and executed by referencing the
        following URL:

        http://jws.site:9090/servlet/com.sun.server.http.pagecompile.
        jsp92.JspServlet/board.html

        It is possible to write Java code that will allow arbitrary
        commands to be executed on the underlying operating system by
        using the Runtime.getRuntime().exec() method.

        Sun's Java Web Server FAQ does mention removing unnecessary
        examples when deploying the server for a production environment.
        However, if there are applications that write user inputs to a
        data file on the server it may be possible to exploit this
        vulnerability.

Proof of concept

        The example below shows how to upload and run code that
        displays "Hello World", coming from the server.

        Given below is JSP code that will print "Hello World":

        <% String s="Hello World"; %>
        <%=s %>

        Post this code to the bulletin board via:

        http://jws.site:9090/examples/applications/bboard/
                                                    bboard_frames.html

        Verify that the code has indeed been uploaded via:

        http://jws.site:9090/board.html

        Compile and execute this code by referencing the following URL:

        http://jws.site:9090/servlet/com.sun.server.http.pagecompile.
                                            jsp92.JspServlet/board.html

Solution

        Workaround:

        This is not a perfect workaround, just something that stops
        this vulnerability for the time being, but it destroys the
        administrative module's functionality.

        Remove or comment out the line:

        /servlet=invoker

        in the file rules.properties which can be found under:

        jws_directory/properties/server/adminserver/adminservice/
        rules.properties

        Restart the Java Web Server. However this renders the
        administrative module unusable.

        Vendor Fix:

        Please install the following patches on systems running Java
        Web Server:

        Java Web Server Version    Patch ID
        ------------------------   -----------
        1.1.3                      Patch 3
        2.0                        Patch 3

        For Java Web Server versions 1.1.1 and 1.1.2, first upgrade the
        Java Web Server and then install the appropriate patch.

        Patches are available at:

        http://java.sun.com/products/java-server/jws113patch3.html

        http://java.sun.com/products/java-server/jws20patch3.html


Credits

        We would also like to thank Sun Microsystems for their prompt
        reaction to this problem and their co-operation in heightening
        security awareness in the security community.

Disclaimer

        The information contained in this advisory is the copyright
        (C) 2000 of Foundstone, Inc. and believed to be accurate at
        the time of printing, but no representation or warranty is
        given, express or implied, as to its accuracy or completeness.
        Neither the author nor the publisher accepts any liability
        whatsoever for any direct, indirect or conquential loss or
        damage arising in any way from any use of, or reliance placed
        on, this information for any purpose. This advisory may be
        redistributed provided that no fee is assigned and that the
        advisory is not modified in any way.