Recognize-Security

Posted by Trancer on Jan 15 2008

Security Advisory for JSPWiki versions 2.4.104 (latest stable release), 2.5.139 (latest beta version) and below.
Vulnerabilities found:

• .jsp Local File Inclusion
• Cross-Site Scripting

JSPWiki allow users to upload (attach) files to entry pages. Combined with the LFI vulnerability, an attacker can use the information disclosed by the installation file to upload a malicious .jsp file and locally execute it.
By executing malicious server-side code, an attacker may be able to compromise the server.

Actually, this is the only published file inclusion vulnerability I’ve ever seen on a Java based web application.
Well, there’s more out there :-)

PDF version.
TXT version.

Also on:
BID 27785
milw0rm

Categories: Advisories

0 Comments | Comments RSS | TrackBack URL

---