Question

We have deployed a web application in tomcat 6.0 and when we request the URL we are getting the following error in log files. Can you help me in figuring out the error

SEVERE: Servlet.service() for servlet jsp threw exception
    javax.servlet.jsp.JspTagException: Invalid JSP file     %2e%2e/%2e%2e/%2e%2e/%2e%2e/system/autoexec.ncf
    at examples.ShowSource.doEndTag(ShowSource.java:41)
    at org.apache.jsp.jsp.source_jsp._jspService(source_jsp.java:87)
    at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
    at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:388)
    at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:313)
    at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:260)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)     

Answer 1

This is related to this NetWare 6.0 specific expolit.

112119 : Novell NetWare 6.0 Tomcat Source.jsp Traversal Arbitrary File Access

Risk 4 : Netware

The Apache Tomcat server distributed with NetWare 6.0 has a directory traversal vulnerability. As a result, sensitive information could be obtained from the NetWare server, such as the RCONSOLE password located in AUTOEXEC.NCF.

Example :

http://target/examples/jsp/source.jsp?%2e%2e/%2e%2e/%2e%2e/%2e%2e/system/autoexec.ncf

Solution:

Upgrade Tomcat to the latest version, or disable the service if it is not required. Remove default files from the web server. Also, ensure the RCONSOLE password is encrypted and utilize a password protected screensaver for console access.

References:

• CVE-2000-1210
• OSVDB-7203

CVSS Information:

Low Attack Complexity, Complete Confidentiality Impact

Credit:

Tenable : 2009-12-04

Patch your server.