Apache JackRabbit 2.0.0 – webapp XPath Injection - 体验盒子

作者： ADEO Security

日期： 2010-08-11

类别：

webapps

平台：

jsp

来源：https://www.exploit-db.com/exploits/14617/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

# Title: Apache JackRabbit webapp XPath Injection

# Author: ADEO Security

# Published: 11/08/2010

# Version: 2.0.0 (Possible all versions)

# Vendor: http://www.apache.org

# Download: http://www.apache.org/dyn/closer.cgi/jackrabbit/2.0.0/jackrabbit-2.0.0-src.zip

# Description: "Apache Jackrabbit is a fully conforming implementation

of the Content Repository for Java Technology API (JCR, specified in

JSR 170 and 283).

A content repository is a hierarchical content store with support for

structured and unstructured content, full text search, versioning,

transactions, observation, and more.

Apache Jackrabbit is a project of the Apache Software Foundation."

# Credit: Vulnerability founded by Canberk BOLAT

- Mail: canberk.bolat[AT]adeo.com.tr

- Web: http://security.adeo.com.tr

# Vulnerability:

In search.jsp file HTTP GET parameter "q" included to XPath query

without sanitised if its start with word "related:".

search.jsp

...

String q = request.getParameter("q");

...

if (q != null && q.length() > 0) {

String stmt;

if (q.startsWith("related:")) {

String path = q.substring("related:".length());

stmt = "//element(*, nt:file)[rep:similar(jcr:content,

'" + path + "/jcr:content')]/rep:excerpt(.) order by @jcr:score

descending";

queryTerms = "similar to <b>" +

Text.encodeIllegalXMLCharacters(path) + "</b>";

}

...