DDIVRT-2011-33 IBM WebSphere Application Server 'help' Servlet Plug-in Bundle Directory Traversal [CVE-2011-1359]
July 28, 2011
Digital Defense, Inc. Vulnerability Research Team Credit: Javier Castro, sxkeebler and r@b13$
The default installation of the IBM WebSphere Application Server is deployed with a 'help' servlet which is designed to serve supporting documentation for the WebSphere system. When the 'help' servlet processes a URL that contains a reference to a Java plug-in Bundle that is registered with the Eclipse Platform Runtime Environment of the WebSphere Application Server, the 'help' servlet fails to ensure that the submitted URL refers to a file that is both located within the web root of the servlet and is of a type that is allowed to be served.
An unauthenticated remote attacker can use this weakness in the 'help' servlet to retrieve arbitrary system files from the host that is running the 'help' servlet. This can be accomplished by submitting a URL which refers to a registered Java plug-in Bundle followed by a relative path to the desired file.
IBM has released a patch for this issue. The patch is available through APAR PM45322.
WebSphere Application Server Version 8.0 WebSphere Application Server Version 7.0 WebSphere Application Server Version 6.1
Vendor Name: IBM Vendor Website: http://www-01.ibm.com/software/webservers/appserv/was/library/