Resin Application Server 4.0.36 Source Code Disclosure Vulnerability

vendor:

Resin Professional Web And Application Server

by:

Gjoko 'LiquidWorm' Krstic

7,5

CVSS

HIGH

Source Code Disclosure

200

CWE

Product Name: Resin Professional Web And Application Server

Affected Version From: Resin Professional Web And Application Server 4.0.36

Affected Version To: Resin Professional Web And Application Server 4.0.36

Patch Exists: NO

Related CWE: N/A

CPE: a:caucho_technology:resin_professional_web_and_application_server:4.0.36

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 amd64 6.1

2013

Resin Application Server 4.0.36 Source Code Disclosure Vulnerability

The vulnerability is caused do to an improper sanitization of the 'file' parameter when used for reading help files. An attacker can exploit this vulnerability by directly requesting a '.jsp' file for example in the root directory of the server to view its source code that might reveal sensitive information.

Mitigation:

Ensure that the 'file' parameter is properly sanitized before being used for reading help files.

Source

Exploit-DB raw data:

Resin Application Server 4.0.36 Source Code Disclosure Vulnerability


Vendor: Caucho Technology, Inc.
Product web page: http://www.caucho.com
Affected version: Resin Professional Web And Application Server 4.0.36

Summary: Resin is the Java Application Server for high traffic
sites that require speed and scalability. It is one of the earliest
Java Application Servers, and has stood the test of time due to
engineering prowess.

Desc: The vulnerability is caused do to an improper sanitization
of the 'file' parameter when used for reading help files. An
attacker can exploit this vulnerability by directly requesting
a '.jsp' file for example in the root directory of the server
to view its source code that might reveal sensitive information.

Tested on: Resin Professional 4.0.36 (built Fri, 26 Apr 2013 03:33:09 PDT)
           Java HotSpot(TM) 64-Bit Server VM 23.3-b01
           4 cpu, Windows 7 amd64 6.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5144
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5144.php


01.06.2013

--


http://127.0.0.1:8080/resin-doc/viewfile/?file=index.jsp
http://127.0.0.1:8080/resin-doc/viewfile/?contextpath=/.\../&servletpath=&file=index.jsp
http://127.0.0.1:8080/resin-doc/viewfile/?contextpath=/.&servletpath=&file=index.jsp