IBM WebSphere Widespread configuration JSP disclosure Release Date: 04/13/2005 Severity: High [Systems Affected] * IBM WebSphere Application 6 and prior. [Description] The practice of sharing the document root of the app server within the document root of the web server creates a security exposure that can result in the jsp source being served up as plain text by the web server. The plug-in has a set of rules used to determine whether a given request will be handled by the app server. When an incoming request fails to match those rules, the plug-in returns control to the web server so that the web server can fulfill the request. In this case, the unknown host header causes the plug-in to return control to the web server because the rules don't indicate the app server should handle it. Therefore, the web server looks for the request in the web server document root. Since the jsp source is stored in the document root of the web server the web server finds the file and serves it as plain text. The following is a demonstration on how to replicate the issue. HTTP request sent ----------------- GET /index.jsp HTTP/1.0 Host: NonExistentHost HTTP response received ---------------------- HTTP/1.1 200 OK Via: HTTP/1.1 websphereserver (IBM-PROXY) Date: Wed, 09 Mar 2005 21:39:43 GMT Server: IBM_HTTP_Server/1.3.12.6 Apache/1.3.12 (Unix) Last-Modified: Tue, 01 Mar 2005 18:35:02 GMT ETag: "515e0007-1d72-4224b5d6" Accept-Ranges: bytes Content-Length: 7538 Content-Type: text/plain <%@ include file="/main/inc/alt-header-0.inc" %> <%@ include file="includes/tabincv4.jsp" %> <%@ include file="includes/tactic.jsp" %> <%=headerjs%> <jsp:include page="<%=tabhdrinc %>" flush="true"/> [Remediation] To eliminate this exposure, you should move the app server jsp source outside of the web server document root. Then, when this request comes in with the unknown host header the plug-in will return control to the web server and the web server will fail to find the file in the document root. Therefore, the web server will return 404 File Not Found rather than the jsp source. [Vendor Information] The vendor was contacted repeatedly without any conclusive results. Contact Information spilabs@xxxxxxxxxxxxxxx SPI Dynamics, Inc. 115 Perimeter Center Place N.E. suite 1100 Atlanta, GA. 30346 Toll-Free Phone: (866) 774-2700 SPI Dynamics was founded in 2000 by a team of accomplished Web security specialists; SPI Dynamics is the leader in Web application security technology. With such signature products as WebInspect, SPI Dynamics is dedicated to protecting companies' most valuable assets. SPI Dynamics has created a new breed of Internet security products for the Web application, the most vulnerable yet least secure component of online business infrastructure. Copyright (c) 2005 SPI Dynamics, Inc. All rights reserved worldwide.
