On Tue, Feb 19, 2002 at 03:51:01PM +0100, Thomas Springer wrote: > Requesting http://site/servlets/gnujsp/[dirname]/[file] on a site running > gnujsp, reveals directory-listing of any webdir including wwwroot, it also > reveals the script-source of certain (not all!) script-types, depending on > webserver-config. The actual hole is in JServ (a servlet engine for which GNUJSP was mainly written) since it sets the servlet PathInfo to [dirname]/[file] in the above example. The GNUJSP servlet then incorrectly assumes that the request was made to "http://site/[dirname]/[file]". > I don't know enough about gnujsp to provide a solution - but it seems to be > kind of a configuration flaw in standard-config of gnujsp. There's a "denyuri" configuration option for GNUJSP but this is not a good fix since 1. The same GNUJSP servlet can be called with multiple URIs (e.g. /servlets/gnujsp and /servlet/gnujsp) 2. It does not seem to work with GNUJSP 1.0.0 and JServ at all when there are servlet aliases A more secure solution is the attached patch for GNUJSP 1.0.0 and 1.0.1 which forbids all direct requests to the GNUJSP servlet. Only files which are mapped to the GNUJSP servlet (in most cases *.jsp) can be accessed then. -- Stefan Gybas trustsec IT solutions GmbH
This archive was generated by hypermail 2b30 : Wed Feb 20 2002 - 09:13:23 PST