Description
The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- Apache Tomcat 3.2.3/3.2.4 - 'Source.jsp' Information Disclosure EDB-21490 · remote · May 29, 2002 · verified
- Apache Tomcat 3.2.3/3.2.4 - Example Files Web Root Full Path Disclosure EDB-21491 · remote · May 29, 2002 · verified
- Apache Tomcat 3.2.3/3.2.4 - 'RealPath.jsp' Information Disclosuree EDB-21492 · remote · May 29, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- VU#116963 third-party-advisory
- 4876 vdb-entry
- http://www.procheckup.com/security_info/vuln_pr0206.html
- http://www.procheckup.com/security_info/vuln_pr0205.html
- tomcat-sample-reveal-path(9208) vdb-entry
- 20020529 Vulnerability in Apache Tomcat v3.23 & v3.24 (part 2) mailing-list
- 20020529 Vulnerability in Apache Tomcat v3.23 & v3.24 mailing-list
- http://www.procheckup.com/security_info/vuln_pr0207.html
- 4877 vdb-entry
- 4878 vdb-entry