Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From the Area51 proposal

share|improve this question
    
Also directory traversal attacks. Remember to use whitelists (better avoid any kind of trusting of untrustworthy data). –  Tom Hawtin - tackline Nov 22 '10 at 17:02

2 Answers 2

up vote 12 down vote accepted

Accordingly to the following resources:

we can conclude that Null Byte injections are possible in Java.

share|improve this answer

Null byte injection depends on a mismatch in the way that strings are handled.

e.g. Java stores the length of the string independently of the content of the string, while C starts at the beginning of the string and checks for a Null Byte to indicate the end of the string.

As a result, Java code can perform checks like "does the file requested end with .jsp" on a string like "/etc/shadow%00.jsp" (where %00 represents the null byte), and return true, while passing this string to "new FileInputStream()" will result in the underlying OS (both Windows and Linux) trying to open "/etc/shadow".

(Relevance of trying to open /etc/shadow on Windows is left as an exercize for the reader :-) )

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.