[OODT-657] Security vulnerability in web-grid allows the listing and downloading of any file on system

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.6
• Fix Version/s: 0.7
• Component/s: grid, product server
• Skill Level: Don't Know (Unsure) - The default level
• Assignee: Unassigned
• Reporter: Rishi Verma
• Created: 23/Oct/13 21:09
• Updated: 24/Oct/13 16:47
• Resolved: 24/Oct/13 00:06

Description

The web-grid framework currently has a security vulnerability that allows an attacker to list and download any file on the system.

As it turns out, the "OFSN" parameter within the URL requests passed to registered product handlers is not validated (for accessing UNIX-style parent directory codes) by either web-grid or the product handlers themselves. Thus, arbitrary file paths (containing the UNIX-style parent directory codes) can be sent in and, in effect, allow the downloading of any file on the system.

e.g. http://localhost:8080/web-grid-0.7-SNAPSHOT/prod?q=OFSN=/../../../../../etc/passwd+AND+RT%3DRAW

I'm elevating this issue to critical level.