| VID |
22089 |
| Severity |
20 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
Servlet |
| Detailed Description |
The ServletExec ISAPI filter disclose the physical path.
ServletExec 4.1 ISAPI is a Java Servlet/JSP Engine for IIS(Internet Information Server) and is implemented as an ISAPI filter. The JSP functionality is provided by a servlet which is enabled by default and contains 'Path Disclosure' security flaw.
By requesting a non-existent .JSP file, or by invoking the JSPServlet directly and supplying no filename, it is possible to make the ServletExec ISAPI filter disclose the physical path of the webroot. It is possible to invoke the class 'com.newatlanta.servletexec.JSP10Servlet' directly by requesting a url such as the below. If no filename is supplied to it, then it returns an error message disclosing the physical path of the web root.
* URL : /servlet/com.newatlanta.servletexec.JSP10Servlet
* Error messages : Error. The file was not found. (filename = f:\inetpub\wwwroot\servlet\com.newatlanta.servletexec.JSP10Servlet\) |
| Recommendation |
Use the main ServletExec Admin UI(http://localhost/servlet/admin) to set a global error page for the entire ServletExec Virtual Server.
Specifies a relative URL to be returned when an error occurs in "Error Page" on the "Configure Server" subpage of the "Manage Servers" admin page. |
| Related URL |
CVE-2002-0893 (CVE) |
| Related URL |
4795 (SecurityFocus) |
| Related URL |
9140 (ISS) |
|
