Minded Security Labs: Advisory #MSA080801
Tomcat File Inclusion Vulnerabity
Tested OS:
Linux Ubuntu 8.04
Tested Tomcat Versions:
Tomcat <= 6.0.16
Tomcat <= 5.5.26
Tomcat <= 4.1.37
Tomcat <= 5.0.x
Tomcat <= 4.0.x
Tomcat <= 3.x
Note: several Tomcat based application server such as JBoss, glassfish
and Sun Java System Web Server could be affected as well.
Vulnerability identifier:
CVE-2008-2370
Minded Security ReferenceID:
MSA080801
Credits:
Discovery by
Stefano Di Paola of Minded Security
Reference: MSA080801
Solution:
Upgrade to latest Tomcat version or patches:
http://tomcat.apache.org/
Summary
Tomcat server fails in normalizing the path of uri part including the
query string in the normalization algorithm, leading to potential directory
traversal in the context of the web server root.
Proof of Concept
Let's suppose a server side Jsp is used to dispatch requests to internal pages
passing parts of the query string.
---page.jsp---
<%
pageContext.forward("/page2.jsp?parameter="+request.getParameter("aparam"))
%>
---end page.jsp----
Tomcat server fails in normalizing the path of uri part including the query
string in the normalization algorithm.
In particular the problem lies in the fact that Tomcat calls
RequestUtil.normalize(path);
before parsing the url for '?'.
Infact, the string will become:
pageContext.forward("/page.jsp?parameter=/../WEB-INF/web.xml");
This fools Tomcat considering
'page2.jsp?somepar=someval&par='
as a file and then when normalize() is called, the presence of
/../
makes the argument of forward() to point to:
/WEB-INF/web.xml
and will send the content of web.xml as response to our request.
Obviously the same could be done for every class and file existing in
the root of the application.
Disclosure Timeline
13/06/2008 Initial vendor notification
17/06/2008 Vendor Confirmed
15/07/2008 Coordinated public disclosure
01/08/2008 Vendor Security Bullettin
04/08/2008 Minded Security Research Lab Advisory
Acknowledgements
Minded Security would like to thanks Mario Manfredi and Loris Delpero
for initial heads up.
Disclaimer
The information within this paper may change without notice. Use
of this information constitutes acceptance for use in an AS IS
condition. There are NO warranties with regard to this information.
In no event shall the author be liable for any damages whatsoever
arising out of or in connection with the use or spread of this
information.
Any use of this information is at the user's own risk.
Permission is hereby granted for the redistribution of this Alert
electronically. It is not to be edited in any way without express
consent of Minded Security Research Lab. If you wish to reprint the
whole or any part of this Alert in any other medium excluding
electronic medium, please e-mail research@mindedsecurity.com
for permission.
Copyright (c) 2007 Minded Security, S.r.l.
