Bugtraq mailing list archives
BEA WebLogic /file/ showcode vulnerability
From: stuart.mcclure () FOUNDSTONE COM (stuart.mcclure () FOUNDSTONE COM)
Date: Wed, 21 Jun 2000 02:36:25 -0400
Foundstone, Inc. http://www.foundstone.com "Securing the Dot Com World" Security Advisory BEA's WebLogic ---------------------------------------------------------------------- FS Advisory ID: FS-062100-3-BEA Release Date: June 21, 2000 Product: WebLogic Vendor: BEA Systems (http://www.beasys.com) Vendor Advisory: Contact vendor. Type: Unparsed pages: Show code vulnerability Severity: Low to Medium (depending on JSP/JHTML coding practices) Author: Saumil Shah (saumil.shah () foundstone com) Shreeraj Shah (shreeraj.shah () foundstone com) Stuart McClure (stuart.mcclure () foundstone com) Foundstone, Inc. (http://www.foundstone.com) Operating Systems: All operating systems Vulnerable versions: BEA WebLogic Server and Express 5.1.x BEA WebLogic Server and Express 4.5.x BEA WebLogic Server and Express 4.0.x BEA WebLogic Server and Express 3.1.8 Note: No currently available versions of BEA WebLogic Enterprise are affected. Foundstone Advisory: http://www.foundstone.com ---------------------------------------------------------------------- Description A show code vulnerability exists with BEA's WebLogic 5.1.0 allowing an attacker to view the source code of any file within the web document root of the web server. Details WebLogic relies on four main Java Servlets to serve different kinds of files. These servlets are: FileServlet - for plain HTML pages SSIServlet - for Server Side Includes pages PageCompileServlet - for JHTML pages JSPServlet - for Java Server Pages Looking at the weblogic.properties file, here is how each of these servlets are registered: weblogic.httpd.register.file=weblogic.servlet.FileServlet weblogic.httpd.register.*.shtml= weblogic.servlet.ServerSideIncludeServlet weblogic.httpd.register.*.jhtml= weblogic.servlet.jhtmlc.PageCompileServlet weblogic.httpd.register.*.jsp= weblogic.servlet.JSPServlet Further along the weblogic.properties file, there is a default servlet which is called upon if a requested file does not have a registered handler. The lines below show how the default servlet is registered. # Default servlet registration # ------------------------------------------------ # Virtual name of the default servlet if no matching servlet # is found weblogic.httpd.defaultServlet=file Thus, if the file path in the URL is prefixed with "/file/", it causes WebLogic to invoke the default servlet, which causes pages to be displayed without being parsed or compiled. Proof of concept It is easy to verify this vulnerability for a given system. Prefixing the path to web pages with "/file/" in the URL causes the file to be displayed without being parsed or compiled. For example if the URL for a file "login.jsp" is: http://site.running.weblogic/login.jsp then accessing http://site.running.weblogic/file/login.jsp would cause the unparsed contents of the file to show up in the web browser. Solution Workaround (The vendor recommends) Do not use the example configuration for the FileServlet in production situations. It is possible to view the source of a JSP/JHTML file in a browser if you do. For more information on the file servlet, see "Setting up the File Servlet" in the online documentation at: http://www.weblogic.com/docs51/admindocs/http.html#file The example registrations look like this: weblogic.httpd.register.file=weblogic.servlet.FileServlet weblogic.httpd.initArgs.file=defaultFilename=index.html weblogic.httpd.defaultServlet=file There are two ways to avoid this: * Register the file servlet with a name that uses a random string that will be difficult to guess. For example, the following registrations will register the file servlet as 12foo34: weblogic.httpd.register.12foo34=weblogic.servlet.FileServlet weblogic.httpd.initArgs.12foo34=defaultFilename=index.html weblogic.httpd.defaultServlet=12foo34 * Register the file servlet using wild cards representing all of the file extensions you will be serving. For example, the following registrations register the file servlet to serve .html files: weblogic.httpd.register.*.html=weblogic.servlet.FileServlet weblogic.httpd.initArgs.*.html=defaultFilename=index.html weblogic.httpd.defaultServlet=*.html Repeat the above registrations for all the file types you will be serving, for example, *.gif, *.jpg, *.pdf, *.txt, etc. Note: This information is documented in the BEA WebLogic Server and Express documentation at: http://www.weblogic.com/docs51/admindocs/lockdown.html Fix Contact the vendor. Credits We would also like to thank BEA Systems for their prompt and serious reaction to this problem.
Current thread:
- Re: NAI WebShield SMTP does not scan base64 encoding Fronck, Destry (Jun 20)
- Re: NAI WebShield SMTP does not scan base64 encoding chris.paget () ANALYSYS COM (Jun 20)
- BlackICE by Network ICE Corp vulnerability against Back Orifice 1.2 Juancho Forlanda (Jun 20)
- BEA WebLogic /file/ showcode vulnerability stuart.mcclure () FOUNDSTONE COM (Jun 20)
- Re: BlackICE by Network ICE Corp vulnerability against Back Orifice 1.2 Mike DeMaria (Jun 21)
- <Possible follow-ups>
- Re: NAI WebShield SMTP does not scan base64 encoding Sato, Ken (Jun 20)
- Microsoft Security Bulletin MS00-038 Update Microsoft Product Security (Jun 20)
- rh 6.2 - gid compromises, etc Michal Zalewski (Jun 21)
- Immunix OS 6.2 (StackGuarded Red Hat 6.2) Crispin Cowan (Jun 21)
- Warning regarding new kernel RPMs Joseph V Moss (Jun 21)
- Re: Warning regarding new kernel RPMs Dave Walter (Jun 22)
- Re: rh 6.2 - gid compromises, etc [+ MORE!!!] Stan Bubrouski (Jun 21)
- Re: rh 6.2 - gid compromises, etc [+ MORE!!!] Wietse Venema (Jun 23)
- Re: rh 6.2 - gid compromises, etc Stan Bubrouski (Jun 22)