Rapid7 Security Advisory R7-0030: Caucho Resin Multiple Path Disclosure Vulnerabilities

_______________________________________________________________________
                        Rapid7 Security Advisory
            Visit http://www.rapid7.com/ to download NeXpose,
        SC Magazine Winner of Best Vulnerability Management product.
_______________________________________________________________________

Rapid7 Advisory R7-0030
Caucho Resin Multiple Path Disclosure Vulnerabilities

   Published:  May 14, 2007
   Revision:   1.0
   http://www.rapid7.com/advisories/R7-0030

1. Affected system(s):

   KNOWN VULNERABLE:
    o Caucho Resin Professional v3.1.0 for Windows
    o Caucho Resin v3.1.0 for Windows
    o Caucho Resin v3.0.21 for Windows
    o Caucho Resin v3.0.20 for Windows
    o Caucho Resin v3.0.19 for Windows
    o Caucho Resin v3.0.18 for Windows
    o Caucho Resin v3.0.17 for Windows

   KNOWN FIXED:
    o Caucho Resin v3.1.1 for Windows
    o Caucho Resin Professional v3.1.1 for Windows

2. Summary

   Caucho Resin for Windows contains two path disclosure vulnerabilities
   which could be used by an attacker to attain the full system path to
   Resin's web application directory.

   Rapid7 has updated NeXpose to check for this vulnerability. Licensed
   customers will receive the new vulnerability checks automatically.
   Visit www.rapid7.com to register for a free demo of NeXpose.

3. Vendor status and information

   Caucho Technology, Inc.
   http://www.caucho.com/

   Caucho was notified of this vulnerability on May 3rd, 2007.
   They fixed this vulnerability in the latest unofficial snapshot
   of Resin 3.1.1, available from Caucho's website.

4. Solution

   Upgrade to Caucho Resin 3.1.1 or later.

5. Detailed analysis

   Caucho Resin is vulnerable to multiple path disclosure vulnerabilities
   due to insufficient sanitizing of user-supplied paths while (1) attempting
   to deploy web applications and (2) attempting to display .xtp files.

   1.  A request from any unauthenticated remote user in the form of:

         http://victim:8080/%20

   2.  A request from any unauthenticated remote user in the form of:

         http://victim:8080/[webapp]/%20.xtp

   In both cases, the full system path to the Caucho Resin server is
   disclosed due to uncaught java IOExceptions reported to the requesting
   user.

6. Credit

   Discovered by Derek Abdine of Rapid7.

7. Contact Information

   Rapid7, LLC
   Email: advisory@rapid7.com
   Web: http://www.rapid7.com
   Phone: +1 (617) 247-1717

8. Disclaimer and Copyright

   Rapid7, LLC is not responsible for the misuse of the information
   provided in our security advisories. These advisories are a service
   to the professional security community. There are NO WARRANTIES with
   regard to this information. Any application or distribution of this
   information constitutes acceptance AS IS, at the user's own risk.
   This information is subject to change without notice.

   This advisory Copyright (C) 2007 Rapid7, LLC. Permission is hereby
   granted to redistribute this advisory, providing that no changes are
   made and that the copyright notices and disclaimers remain intact.