Sun Java Web Server allows attackers to execute arbitrary commands remotely

Involved procedures:
Solaris and Windows NT

Description:
Sun Java Web Server allows attackers to execute arbitrary commands remotely

Details:
Sun's Java Web server has multiple security issues, allowing attackers to remotely execute commands with web server privileges.

Its Web management module listens to port 9090 and uses http processing management commands.
"Com. sun. server. http. pagecompile. jsp92.JspServlet" servlet is used to compile and execute JSP files,
By adding the "/servlet/" prefix, remote users can use this servlet to compile and execute any JSP files in the management directory.
File.

By default, this server contains a message demonstration program that allows users to pass
Http://jws.site: 9090/examples/applications/bboard/bboard_frames.html
The documents are submitted and saved in board.html.

Attackers can input some JSP statements through the message board and then call
Use "com. sun. server. http. pagecompile. jsp92.JspServlet" to compile and execute the board.html file:

The http://jws.site: 9090/servlet/com. sun. server. http. pagecompile. jsp92.JspServlet/board.html

This causes attackers to remotely execute commands with web server privileges.

The following code is only used to test and study this vulnerability. If you use it for an improper approach, you are solely responsible for the consequences.

Use the following JSP code to print "Hello World ":
% String s = "Hello World"; %>
<% = S %>
Submit in message board:
Http://jws.site: 9090/examples/applications/bboard/bboard_frames.html
Then confirm that you have submitted through http://jws.site: 9090/board.html.
Compile and execute the code below:
Http://jws.site: 9090/servlet/com. sun. server. http. pagecompile

Solution:
Download and install the patch:
Http://java.sun.com/products/java-server/jws113patch3.html
Http://java.sun.com/products/java-server/jws20patch3.html

Additional information:
Saumil Shah (saumil.shah@foundstone.com)
Shreeraj Shah (shreeraj.shah@foundstone.com)
Stuart McClure (stuart.mcclure@foundstone.com)
Foundstone, Inc. (http://www.foundstone.com)

Related Sites:
Http://www.foundstone.com