Skip to main content
Information Security

Return to Question

Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Fixed typos, included OS
Source Link
edit approved Nov 21, 2018 at 10:55
mike
edit approved Nov 21, 2018 at 10:55
mike
  • 572
  • 5
  • 17

In recent pentestblack-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the "home"home path of tomcat appTomcat. 

In classic scenario, I tried to read /etc/passwd/etc/passwd but failed to retrieve contents. It seems, apache tomcatApache Tomcat forbids web server from reading outside of web app path. Vulnerable parameter located in GET request and application appends “.jsp”.jsp to that and tries to read it. For example

For example, if we navigate to http://site.com/abc.jsp?param=enhttp://site.com/abc.jsp?param=en then application will try to load /some/folder/somefile_en.jsp/some/folder/somefile_en.jsp file from filesystem. If it fails, it returns HTTP status code 500HTTP status code 500 with java.io.IOException stacktracejava.io.IOException stack-trace. 

For bypassing “.jsp”.jsp restriction, I added “?”? at the end of vulnerable parameter like this http://site.com/abc.jsp?param=asdasd_asdasd/../../../../META-INF/MANIFEST.MF?http://site.com/abc.jsp?param=asdasd_asdasd/../../../../META-INF/MANIFEST.MF?. I was only able to read /META-INF/context.xml, /META-INF/MANIFEST.MF, /WEB-INF/web.xmlthese files.:

  • /META-INF/context.xml
  • /META-INF/MANIFEST.MF
  • /WEB-INF/web.xml

I do not know what other files I can read (because I do not have fuzz list for java apps).

Q: Could you give me fuzz list for finding other juicysensitive files in filesystem or could you suggest me other attack vectors?

P.S. I could enumerate file and directory names based on HTTP response. If file does not exist, this kind of error message appears:   

Trying to read nonexistent file

In recent pentest, I found vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the "home" path of tomcat app. In classic scenario, I tried to read /etc/passwd but failed to retrieve contents. It seems, apache tomcat forbids web server from reading outside of web app path. Vulnerable parameter located in GET request and application appends “.jsp” to that and tries to read it. For example, if we navigate to http://site.com/abc.jsp?param=en then application will try to load /some/folder/somefile_en.jsp file from filesystem. If it fails, it returns HTTP status code 500 with java.io.IOException stacktrace. For bypassing “.jsp” restriction, I added “?” at the end of vulnerable parameter like this http://site.com/abc.jsp?param=asdasd_asdasd/../../../../META-INF/MANIFEST.MF? I was only able to read /META-INF/context.xml, /META-INF/MANIFEST.MF, /WEB-INF/web.xml files. I do not know what other files I can read (because I do not have fuzz list for java apps). Could you give me fuzz list for finding other juicy files in filesystem or could you suggest me other attack vectors?

P.S. I could enumerate file and directory names based on HTTP response. If file does not exist, this kind of error message appears:  Trying to read nonexistent file

In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat. 

In classic scenario, I tried to read /etc/passwd but failed to retrieve contents. It seems, Apache Tomcat forbids web server from reading outside of web app path. Vulnerable parameter located in GET request and application appends .jsp to that and tries to read it.

For example, if we navigate to http://site.com/abc.jsp?param=en then application will try to load /some/folder/somefile_en.jsp file from filesystem. If it fails, it returns HTTP status code 500 with java.io.IOException stack-trace. 

For bypassing .jsp restriction, I added ? at the end of vulnerable parameter like this http://site.com/abc.jsp?param=asdasd_asdasd/../../../../META-INF/MANIFEST.MF?. I was only able to read these files:

  • /META-INF/context.xml
  • /META-INF/MANIFEST.MF
  • /WEB-INF/web.xml

I do not know what other files I can read (because I do not have fuzz list for java apps).

Q: Could you give me fuzz list for finding other sensitive files in filesystem or could you suggest me other attack vectors?

P.S. I could enumerate file and directory names based on HTTP response. If file does not exist, this kind of error message appears: 

Trying to read nonexistent file

added 100 characters in body
Source Link
puni aze
puni aze
  • 11
  • 1
  • 1
  • 3

In recent pentest, I found vulnerability that allowed me to grab source contents of anyfiles (kind of file inclusion) located within the "home" path of tomcat app. For exampleIn classic scenario, I couldtried to read /META-INF/context.xml and other such kind of files (but not /etc/passwd) but failed to retrieve contents. It seems, apache tomcat forbids web server from reading outside of web app path. Vulnerable parameter located in GET request and appended "application appends “.jsp" at the end of user controllable parameterjsp” to that and tries to read it. For example, if URL will be like this;we navigate to http://site.com/abc.jsp?param=en, it then application will try to load /some/folder/lang_ensomefile_en.jsp . I tried to read standard XML files like webfile from filesystem.xml If it fails, contextit returns HTTP status code 500 with java.xml and so on by using requestio.IOException stacktrace. For bypassing “.jsp” restriction, I added “?” at the end of vulnerable parameter like this;this http://site.com/abc.jsp?param=en/../../META-INF/context.xmlhttp://site.com/abc.jsp?param=asdasd_asdasd/../../../../META-INF/MANIFEST.MF? . After this request I was only able to grab contents of that fileread /META-INF/context. Except thisxml, /META-INF/MANIFEST.MF, /WEB-INF/web.xml files. I could not do anything else.not know what other files I can read (because I do not have great experience of pentestingfuzz list for java apps, so I hope, I will get proper answers from here). Please recommend Could you give me file list that I can fuzz to grab more data,list for finding other juicy files in filesystem or alternativecould you suggest me other attack vectors.?

P.S. I could enumerate file and directory names based on HTTP response. If file does not exist, this kind of error message appears: Trying to read nonexistent file

If file exists, I could get contents of that file. I could not traverse to other folders like /etc/.

In recent pentest, I found vulnerability that allowed me to grab source contents of any file within the "home" path of tomcat app. For example, I could read /META-INF/context.xml and other such kind of files (but not /etc/passwd). Vulnerable parameter located in GET and appended ".jsp" at the end of user controllable parameter. For example, if URL will be like this; http://site.com/abc.jsp?param=en, it will try to load /some/folder/lang_en.jsp . I tried to read standard XML files like web.xml, context.xml and so on by using request like this; http://site.com/abc.jsp?param=en/../../META-INF/context.xml? . After this request I was able to grab contents of that file. Except this, I could not do anything else. I do not have great experience of pentesting java apps, so I hope, I will get proper answers from here. Please recommend me file list that I can fuzz to grab more data, or alternative attack vectors.

P.S. I could enumerate file and directory names based on HTTP response. If file does not exist, this kind of error message appears: Trying to read nonexistent file

If file exists, I could get contents of that file. I could not traverse to other folders like /etc/.

In recent pentest, I found vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the "home" path of tomcat app. In classic scenario, I tried to read /etc/passwd but failed to retrieve contents. It seems, apache tomcat forbids web server from reading outside of web app path. Vulnerable parameter located in GET request and application appends “.jsp” to that and tries to read it. For example, if we navigate to http://site.com/abc.jsp?param=en then application will try to load /some/folder/somefile_en.jsp file from filesystem. If it fails, it returns HTTP status code 500 with java.io.IOException stacktrace. For bypassing “.jsp” restriction, I added “?” at the end of vulnerable parameter like this http://site.com/abc.jsp?param=asdasd_asdasd/../../../../META-INF/MANIFEST.MF? I was only able to read /META-INF/context.xml, /META-INF/MANIFEST.MF, /WEB-INF/web.xml files. I do not know what other files I can read (because I do not have fuzz list for java apps). Could you give me fuzz list for finding other juicy files in filesystem or could you suggest me other attack vectors?

P.S. I could enumerate file and directory names based on HTTP response. If file does not exist, this kind of error message appears: Trying to read nonexistent file

Source Link
puni aze
puni aze
  • 11
  • 1
  • 1
  • 3

Tomcat application arbitrary file read exploitation

In recent pentest, I found vulnerability that allowed me to grab source contents of any file within the "home" path of tomcat app. For example, I could read /META-INF/context.xml and other such kind of files (but not /etc/passwd). Vulnerable parameter located in GET and appended ".jsp" at the end of user controllable parameter. For example, if URL will be like this; http://site.com/abc.jsp?param=en, it will try to load /some/folder/lang_en.jsp . I tried to read standard XML files like web.xml, context.xml and so on by using request like this; http://site.com/abc.jsp?param=en/../../META-INF/context.xml? . After this request I was able to grab contents of that file. Except this, I could not do anything else. I do not have great experience of pentesting java apps, so I hope, I will get proper answers from here. Please recommend me file list that I can fuzz to grab more data, or alternative attack vectors.

P.S. I could enumerate file and directory names based on HTTP response. If file does not exist, this kind of error message appears: Trying to read nonexistent file

If file exists, I could get contents of that file. I could not traverse to other folders like /etc/.