Getting remote access via path traversal for Java webapps

Question

I've found path traversal for a web application and I can get the contents of all files the webserver user have read access to. I want to further exploit this.

With PHP websites I'm sometimes able to get remote access the following way:

• I get reponse HTML pages with parts of it being the contents of the requested file
• I manipulate my requests so that executable PHP code gets written to the webserver logfiles.
• I try to GET logfile contents thus executing my PHP code.

This is only possible if the remote file contents are shown via include or require or stupidly eval'd. In most cases it's something like file_get_contents and echo, which does not execute the code. But there were cases where I succeeded doing so, and I got myself a little shell that uses system to execute anything passed as a GET parameter with the privileges of the webserver user.

My question is, is there a similar vulnerability for webapps written in Java? Is it common? How do I exploit it?

Answer 1

It is impossible to run executables with java if the code doesn't contain a line like :

Runtime.getRuntime().exec(variableProvidedByUser);

Now indirect exploitation of an upload vulnerability (given that the file type verification fails) is still possible if you know that the file is executed by a process other than java.

Keep in mind that there are applications that just BLOB files in databases so that executing the file isn't possible if the application doesn't explicitly do so or that java just reads using a byteStreamReader which will represent an array of bytes.

Another thing to keep in mind is that java runs in a virtual machine (JVM) and that java is a compiled language and that you cannot access user space in an arbitrary way nor simply uploading scripts and executing them.