I was pen testing a java web application, I could upload a malicious JSP file which was generated using METASPLOIT, however, I could not put the JSP file in the server directory so that it can be executed and a web shell session opened.
However, I do not know if the attacker could somehow exploit such file.
Should I report it as a vulnerability and ask the developers to scan the file before uploading or I just ignore it?
The fact that you can upload a JSP file is in itself not a vulnerability.
Particularly, if the file contents are put in a database there is no actual JSP file on disk. Therefore, it can't be placed in the webroot and it won't be executed.
If the file is written to disk and you can put it in an arbitrary location, there is a risk. If you failed to exploit this because you don't know the path of the webroot, for example, someone with more time and knowledge may succeed in exploiting it.
I wouldn't advise scanning uploaded files for JSP content. If there is no way to put the uploaded file in the webroot there is no risk.
At best, the risk itself is an Unrestricted File Upload function. - However, the file in its present state couldn't be executed. This suggests that the uploads are stored in a folder that does not have execute permission.
However in the present configuration, it's a reduced risk. It's worth noting the risk of the unrestricted file-upload as a low or medium risk finding since the code is not rendered. Use the CVSS calculator to determine. If there's ever an administrator error re-configuring the file-system, then they should be cognizant of possible critical risk for code execution and seek to move towards using best practice. OWASP recommends using server-side enforced file upload controls (always push for WHITELISTING!) to prevent them from the open-door possibility of human error.
