[JSPWIKI-315] Attachment upload allows .jsp files

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.x
• Fix Version/s: 2.6.4, 2.8
• Component/s: Core & storage

Environment

All

• Assignee: Unassigned
• Reporter: Andrew R. Jaquith
• Created: 16/Jul/08 17:51
• Updated: 23/Aug/08 16:53
• Resolved: 07/Aug/08 03:30

Description

http://marc.info/?l=bugtraq&m=120300554011544&w=2

As described in the vulnerability disclosure. An uploaded file attachment, if a JSP, will execute when viewed. Steps to reproduce:
1. Create a JSP called Foo.jsp with these contents: URI: <%=request.getRequestURI()%>
2. Navigate to page Main and upload this attachment/
3. Supplying the URL http://localhost:8080/JSPWiki/Foo.jsp will execute the JSP and display the URI.

However, uploading a file that contains JSP content, but does NOT have the .jsp suffix seems fine. E.g., http://localhost:8080/JSPWiki/Bar (no extension) does cause the contents of Bar to be compiled and executed.

Recommendation: any files with .jsp extension should be forcibly stripped out from the file, or else simply rejected.