JSPWiki Multiple Vulnerabilities
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: JSPWiki Multiple Vulnerabilities
- From: Trancer <mtrancer@xxxxxxxxx>
- Date: Wed, 13 Feb 2008 23:45:28 +0200
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:user-agent:mime-version:to:subject:x-enigmail-version:content-type:content-transfer-encoding:from; bh=I6owfjtlVPIRiUaOQPvjwYjBBrESjV2VHbh/E2YQF3k=; b=IJ7iou28j9R3FpyMjtWejzllosDbSYtRZtM4u7MbbtQKD0USQ71oD9JivHZdsYsZj6mBhEhK/Y3iSNEAS2NSI5LYQNtc1HZY1HCITuerIcVWFLQVPDVuyub0G1cqwO6W/FWD2gD2/als70plIPPnJmxeUOLl7ElVBmGye8gQ0ys=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:user-agent:mime-version:to:subject:x-enigmail-version:content-type:content-transfer-encoding:from; b=K6qWx5xgddnBbKqelYs3VUQzh+bfkBGkYW7mXBp2ieXvodrWj9+oKBqnCRJDpV1EykREKz8jHpYgURMr0RmxyaZULrp9fboOuy7xHZhe9h4kbhefkLk7fIOvxHwtU6sdD7wRpAOQ/b0G8RqGllLaHFZrRntXxy3S4rhGc9eo2Ko=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
- User-agent: Thunderbird 2.0.0.9 (Windows/20071031)
JSPWiki Multiple Vulnerabilities
Vendor:
Janne Jalkanen JSPWiki – http://www.jspwiki.org
Application Description:
From JSPWiki website - “JSPWiki is a feature-rich and extensible
WikiWiki engine built around a standart J2EE components (Java, servlets,
JSP).”
Tested versions:
JSPWiki v2.4.104
JSPWiki v2.5.139
Earlier versions may also be affected.
JSPWiki Local .jsp File Inclusion Vulnerability.
An input validation problem exists within JSPWiki which allows to
execute (include) arbitrary local .jsp files. An attacker may leverage
this issue to execute arbitrary server-side script code on a vulnerable
server with the privileges of the web server process.
Example (including rss.jsp file from the application root directory):
http://server/JSPWikiPath/Edit.jsp?page=Main&editor=../../../rss
Note: page parameter must be an existing page on the server.
This grants an attacker unauthorized access to sensitive .jsp files on
the server and can lead to information disclosure.
Examples:
http://server/JSPWikiPath/Edit.jsp?page=User&editor=../../../Install
http://server/JSPWikiPath/Edit.jsp?page=User&editor=../../../admin/SecurityConfig
The first example disclose sensitive information such as the full path
of the application on the server, page (and attachments) storage path,
log files and work directory by including the application installation
(Install.jsp).
The second example disclose the application security configurations by
including the JSPWiki Security Configuration Verifier file
(admin/SecurityConfig.jsp).
In addition, JSPWiki allow users to upload (attach) files to entry
pages. An attacker can use the information disclosed by the installation
file to upload a malicious .jsp file and locally execute it.
By executing malicious server-side code, an attacker may be able to
compromise the server.
JSPWiki Cross-Site Scripting Vulnerability.
An attacker may leverage cross-site scripting vulnerability to have
arbitrary script code executed in the browser of an unsuspecting user in
the context of the affected site. This may facilitate the theft of
cookie-based authentication credentials as well as other attacks.
Example:
http://server/JSPWikiPath/Edit.jsp?page=Main&editor=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Original Document:
http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0
Download PDF:
http://www.bugsec.com/up_files/JSPWiki_Multiple_Vulnerabilities.pdf
Credit:
Moshe BA
BugSec LTD. - Security Consulting Company
Tel: +972-3-9622655
Fax: +972-3-9511433
Email: Info -at- BugSec -d0t- com
http://www.bugsec.com
--
Moshe :: Trancer
0nly Human.