1

I'm new to this site. I have a question concerning the upload of dynamic java code into an application running on Tomcat 7.0.34.

I'm doing a penetration testing of a java website and found it's possible to upload arbitrary files with a certain upload functionality. I managed to upload an HTML file for example, which then I can access and is rendered adequately. I tried to upload a jsp file, which was possible, but won't be rendered as HTML and the java code in it isn't executed (I get the tags returned in clear text when I request the file). There are certain limitations to the upload as well:

1) I can't choose where to upload the file

2) Files aren't referenced directly. Instead, when the path to the uploaded file is shown, a random URL is created (every time its shown, a different URL is created), like:

http://site.com/static/path/random/path/myfile.jsp

3) I don't know the real path where the files are being uploaded or if I can access it directly

Under this circumstances do you think it's somehow possible to inject and execute java code server-side? (I know it would be possible with PHP, but with java and Tomcat I don't know)

Note: I don't have access to the tomcat manager or anything like that.

1

As for the point (2) and for the jsp not rendered correctly, It is likely the uploaded files are stored in a database not in the fs. Otherwise a one reason that jsp are not rendered is because tomacat is having problem locating the tag library.

  • Oh, yeah it seems files are being stored in the database. I'm guessing it won't be possible to execute java code in this context. – Diego Alejandro Molina Leiva Nov 1 '13 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.