JasperReports is an open source Java reporting tool that can write to a variety of targets, such as: screen, a printer, into PDF, HTML, Microsoft Excel, RTF, ODT, Comma-separated values or XML files. It can be used in Java-enabled applications, including Java EE or web applications, to generate dynamic content. It reads its instructions from an XML or .jasper file. ~wikipedia
Can you tell me of a scenario in which a malicious jasper file is uploaded and converted to actual java code (jsp shell) and give an attacker shell access?
