Re: IBM AS/400 HTTP Server '/' attack

[Mike Turk <mcturk () us ibm com>]

Mailer: SecurityFocus
In-Reply-To: <3BEA999D.4070304 () yahoo com>

It is possible through HTTP server and servlet engine configurations
that HTML and/or JSP source could be view at the browser.

HTTP Server 
There are configuration settings that could be made where JSP source could 
be displayed in the browser, such as placing JSPs in the document root of 
the HTTP server.  Also, in regards to html pages, if you use a PASS directive 
that allow all file types to be served 
(e.g. Pass /MYsamples/* /QIBM/UserData/MyHtml/*) then you could see the HTML 
source.  If the directive is qualified by file type 
(e.g. Pass /MYsamples/*.html /QIBM/UserData/MyHtml/*) you can prevent 
the request ending with '/' from being serviced.

Servlet Engine:
The problem description does not mention what Servlet engine/JSP processor 
that is being used.  If it is WebSphere, if you have a file serving 
servlet in your web application, it will try to service the request for 
http://www.foo.com/getsource.jsp/.  Like the PASS example above, if you 
limit the types of requests to be served my the simple file servlet by file type, 
you can prevent the source from being displayed.  To do so:
1.  select the simple file servlet for the web app.  
2.  modify the URI in the servlet web path list. 
     a) start by modifying the existing URI.  It may look something like 
default_host/webapp/myapp/
     b) change to something like  default_host/webapp/myapp/*.html
3.  Continue adding URIs for other file types (*.gif, etc...)
4.  Click Apply
5.  Restart the web application

>   IBM's HTTP Server on the AS/400 platform is vulnerable to an attack
> that will show the source code of the page -- such as an .html or .jsp
> page -- by attaching an '/' to the end of a URL.
>
> Compare these two URL's:
>
> http://www.foo.com/getsource.jsp
>
> http://www.foo.com/getsource.jsp/
>
> The later URL will deliver the jsp source to the browser.
>
> I reported this problem to IBM approximately 9 or 10 months ago.
>
> I was told it was a bug but not a security vulnerability. When I
> explained that Microsoft had a similar bug (asp dot bug) they told me
> that "they did not share the same source code base." I replied to this
> ludicrous reply: "Isn't it possible that since you developed servers
> that function in a similar manner you have the same logical bug?" To
> this they were speechless. I imagine that a .jsp page could contain user 
> names and passwords if they are accessing databases, especially if these 
> databases are on the network.
>
> By the way, the IBM HTTP server was derived from an early version of
> Apache. I have not seen Apache servers vulnerable to this bug.
>
> Since I reported this "non-security" bug so long ago I hope it is fixed
> through the regular set of changes. I cannot confirm this bug was fixed.
> As far as I know this vulnerability was not yet reported to the public.
>
> 'ken'