[AXIS2-4279] Local File Inclusion Vulnerability on parsing WSDL related XSD Files

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.4.1
• Fix Version/s: nightly
• Component/s: transports
• Environment: Tomcat 5.5; Axis2 1.4.1
• Assignee: Unassigned
• Reporter: Wolfram Kluge
• Created: 21/Mar/09 00:52
• Updated: 27/Nov/17 12:17
• Resolved: 04/Jan/10 06:19

Description

Hello
i dont know if it is a vulnerability or it is an issue of missconfiguration.

The problem occur by doing the following things,

http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml

i was able to get these files displayed by the web browser. Once i tried this,
furthermore i was also able to get public and private keystore/truststore located in the WEB-IN dir as well.

So please let me know if it is a missconfiguration, and tell me how i can configure more securely.
If its a bug please let me also know!

Thank you in advance!
Wolfram

Issue Links

• relates to: AXIS2-4282 JarFileClassLoader allows resources to be loaded from locations outside of the directory specified in its classpath