Home page logo

bugtraq logo Bugtraq mailing list archives

Re: IBM AS/400 HTTP Server '/' attack
From: Mike Turk <mcturk () us ibm com>
Date: 12 Nov 2001 20:07:32 -0000

Mailer: SecurityFocus
In-Reply-To: <3BEA999D.4070304 () yahoo com>

It is possible through HTTP server and servlet engine configurations
that HTML and/or JSP source could be view at the browser.

HTTP Server 
There are configuration settings that could be made where JSP source could 
be displayed in the browser, such as placing JSPs in the document root of 
the HTTP server.  Also, in regards to html pages, if you use a PASS directive 
that allow all file types to be served 
(e.g. Pass /MYsamples/* /QIBM/UserData/MyHtml/*) then you could see the HTML 
source.  If the directive is qualified by file type 
(e.g. Pass /MYsamples/*.html /QIBM/UserData/MyHtml/*) you can prevent 
the request ending with '/' from being serviced.

Servlet Engine:
The problem description does not mention what Servlet engine/JSP processor 
that is being used.  If it is WebSphere, if you have a file serving 
servlet in your web application, it will try to service the request for 
http://www.foo.com/getsource.jsp/.  Like the PASS example above, if you 
limit the types of requests to be served my the simple file servlet by file type, 
you can prevent the source from being displayed.  To do so:
1.  select the simple file servlet for the web app.  
2.  modify the URI in the servlet web path list. 
     a) start by modifying the existing URI.  It may look something like 
     b) change to something like  default_host/webapp/myapp/*.html
3.  Continue adding URIs for other file types (*.gif, etc...)
4.  Click Apply
5.  Restart the web application

  IBM's HTTP Server on the AS/400 platform is vulnerable to an attack
that will show the source code of the page -- such as an .html or .jsp
page -- by attaching an '/' to the end of a URL.

Compare these two URL's:



The later URL will deliver the jsp source to the browser.

I reported this problem to IBM approximately 9 or 10 months ago.

I was told it was a bug but not a security vulnerability. When I
explained that Microsoft had a similar bug (asp dot bug) they told me
that "they did not share the same source code base." I replied to this
ludicrous reply: "Isn't it possible that since you developed servers
that function in a similar manner you have the same logical bug?" To
this they were speechless. I imagine that a .jsp page could contain user 
names and passwords if they are accessing databases, especially if these 
databases are on the network.

By the way, the IBM HTTP server was derived from an early version of
Apache. I have not seen Apache servers vulnerable to this bug.

Since I reported this "non-security" bug so long ago I hope it is fixed
through the regular set of changes. I cannot confirm this bug was fixed.
As far as I know this vulnerability was not yet reported to the public.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]