I'm new to this site. I have a question concerning the upload of dynamic java code into an application running on Tomcat 7.0.34.
I'm doing a penetration testing of a java website and found it's possible to upload arbitrary files with a certain upload functionality. I managed to upload an HTML file for example, which then I can access and is rendered adequately. I tried to upload a jsp file, which was possible, but won't be rendered as HTML and the java code in it isn't executed (I get the tags returned in clear text when I request the file). There are certain limitations to the upload as well:
1) I can't choose where to upload the file
2) Files aren't referenced directly. Instead, when the path to the uploaded file is shown, a random URL is created (every time its shown, a different URL is created), like:
3) I don't know the real path where the files are being uploaded or if I can access it directly
Under this circumstances do you think it's somehow possible to inject and execute java code server-side? (I know it would be possible with PHP, but with java and Tomcat I don't know)
Note: I don't have access to the tomcat manager or anything like that.