Title: Resin Application Server 4.0.36 Source Code Disclosure Vulnerability
Advisory ID: ZSL-2013-5144
Type: Local/Remote
Impact: Exposure of sensitive information
Risk: (3/5)
Release Date: 07.06.2013

Summary

Resin is the Java Application Server for high traffic sites that require speed and scalability. It is one of the earliest Java Application Servers, and has stood the test of time due to engineering prowess.

Description

The vulnerability is caused do to an improper sanitization of the 'file' parameter when used for reading help files. An attacker can exploit this vulnerability by directly requesting a '.jsp' file for example in the root directory of the server to view its source code that might reveal sensitive information.

Vendor

Caucho Technology, Inc. - http://www.caucho.com

Affected Version

Resin Professional Web And Application Server 4.0.36

Tested On

Resin Professional 4.0.36 (built Fri, 26 Apr 2013 03:33:09 PDT)
Java HotSpot(TM) 64-Bit Server VM 23.3-b01
4 cpu, Windows 7 amd64 6.1

Vendor Status

[01.06.2013] Vulnerability discovered.
[01.06.2013] Contact with the vendor.
[06.06.2013] No response from the vendor.
[07.06.2013] Public security advisory released.

PoC

resin_scd.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] http://cxsecurity.com/issue/WLB-2013060064
[2] http://packetstormsecurity.com/files/121933
[3] http://www.securityfocus.com/bid/60430
[4] http://www.exploit-db.com/exploits/26073/
[5] http://osvdb.org/show/osvdb/94156

Changelog

[07.06.2013] - Initial release
[08.06.2013] - Added reference [1]
[09.06.2013] - Added reference [2]
[10.06.2013] - Added reference [3]
[11.06.2013] - Added reference [4]
[12.06.2013] - Added reference [5]

Contact

Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk