Tomcat may reveal script source code by URL trickery
----------------------------------------------------

Sverre H. Huseby security advisory #3, 2001-03-29



Systems affected
----------------

Tomcat 4.0-b1 (latest milestone) and nighly build as of 2001-03-28
tested.  Other versions may be vulnerable too.  The problem is only
present when using Tomcat's built in web server, not when using Tomcat
with Apache Web Server.

Update 2001-03-31: The Tomcat guys have fixed the problem, and
released Tomcat 4.0 beta 2, which includes a fix for another security
vulnerability too.  You should upgrade to a version at least as new as
4.0 beta 2.


Description
-----------

Tomcat (http://jakarta.apache.org/tomcat/), the Reference
Implementation for the Java Servlet 2.2 and JavaServer Pages 1.1
Technologies, may be tricked into revealing the source code of JSP
scripts by using simple URL encoding.


Details
-------

It seems that the built in web server in Tomcat does URL decoding in
an unreasonable order.  URLs like the following

  http://someplace.com:8080/index.js%70

where %70 is an URL encoded 'p', returns the source code of index.jsp
rather than running the script on the server side.

To speculate (read: guess): The JSP handler is skipped as this URL
does not end in ".jsp", but the static file handler is nevertheless
able to map the URL into a correct file name.


Impact
------

This design error makes it possible to fetch the source code of JSP
scripts.  Such source code may contain database passwords and file
names, and may reveal design errors or programming bugs that make it
possible to further exploit the server or service.



Reported by Sverre H. Huseby, shh@thathost.com