Code execution through JSP RFI?

Question

I'm working on improving my understanding of RFI (Remote File Inclusion), especially in JSP apps.

I've created a vulnerable application that imports a JSP page from another server to replicate the behaviour of a real RFI.

This the import code :

  <c:import url ="http://localhost:8082/rfi.jsp"/>

The rfi.jsp code is only displayed and not executed. Is it possible to achieve code execution using JSP RFI?

Thanks.

Answer 1

With JSP as far as I could analyse it, it is only possible to run a JSP on the attacker server, not on the victim server. (If somebody can disagree, I would be very happy about an example with code).

So in your case localhost:8082 must be the attacker server. To run the code the attacker server must also be a web container e.g. Tomcat in which rfi.jsp is served. Otherwise the server will only deliver a text string of the JSP code, not the executed JSP.

Furthermore

<c:import url ="http://localhost:8082/rfi.jsp"/>

would not really be a Remote File Inclusion vulnerability except an evil developer wanted to include the file intentionally during creation of the code. Typically, a file inclusion vulnerability can be triggered from some form of input possibility, mostly by using a query parameter. So it could look like this in the browser url bar to trigger the vulnerability:

http://myvictimserver/myvulnwebapp/myvulnrfijspfile.jsp?myvulnqueryparameter=http://localhost:8082/rfi.jsp

Where now rfi.jsp contains code that you want to show as an attacker to the victim.

The victim server code must use <c:import> not <jsp:include>, because <c:import> allows external URLs, <jsp:include> does this not, it only works internal so it can open a local file inclusion issue.

A problematic code snippet on the victim side could be:

myvulnrfijspfile.jsp:

<%@ taglib uri = "http://java.sun.com/jsp/jstl/core" prefix = "c" %>
<c:import url="<%= request.getParameter(\"myvulnqueryparameter\")%>" />

with a tomcat folder structure similar to:

tomcat/webapps/myvulnwebapp folder:

.
./myvulnrfijspfile.jsp
./WEB-INF
./WEB-INF/classes
./WEB-INF/lib
./WEB-INF/lib/jstl-1.2.jar

As for the answer of OscarAkaElvis the extracted code

<%
   String p = request.getParameter("p");
   @include file="<%="includes/" + p +".jsp"%>"
%>

is not a RFI vulnerable code, this is LFI, and probably difficult because <%@include> is intended for a static include meaning it is added at compilation time not at runtime (cf https://www.javatips.net/blog/difference-between-static-include-and-dynamic-include).

P.S. I have made some example network for different programming languages with docker in my github repo where you can test it. The above mentioned victim and attack code runs on Apache Tomcat/9.0.21 with JSP 2.3, respectively.

Answer 2

I found this old question, anyway I'll try to answer it.

The answer is yes, but not with the code you put. The RFI (remote file inclusion) is exclusive of PHP, JSP and the uncommon HTML SSI (server side inclusion) as you can see here on its definition: RFI definition.

This code extracted from the link I posted is vulnerable to a JSP RFI.

<%
   String p = request.getParameter("p");
   @include file="<%="includes/" + p +".jsp"%>"
%>

/vulnerable.jsp?p=../../../../var/log/access.log%00 - Unlike PHP, JSP is still affected by Null byte injection, and this param will execute JSP commands found in the web server's access log.