Konrad Windszus created FELIX-6854:
--------------------------------------
Summary: AbstractServlet.spoolResource delivers arbitrary files
visible to classloader
Key: FELIX-6854
URL: https://issues.apache.org/jira/browse/FELIX-6854
Project: Felix
Issue Type: Bug
Components: Web Console
Affects Versions: webconsole-5.0.18
Reporter: Konrad Windszus
There is no limitation on resource names in
https://github.com/apache/felix-dev/blob/762b769b60b41e139fce4a3c1b2c0bb1b2569155/webconsole/src/main/java/org/apache/felix/webconsole/servlet/AbstractServlet.java#L127
which allows to expose arbitrary class files via the Felix WebConsole.
Only the underlying bundle classloader may limit visibility.
Although usually only admin like users have access to the Felix WebConsole,
exposing all classloader resources unnecessarily may leak sensitive information.
Would be best if each web console plugin maintains an allow list which
resources may be requested but this would probably require a non backwards
compatible fix.
The same issue occurs in the deprecated AbstractWebConsolePlugin
(https://github.com/apache/felix-dev/blob/762b769b60b41e139fce4a3c1b2c0bb1b2569155/webconsole/src/main/java/org/apache/felix/webconsole/AbstractWebConsolePlugin.java#L483).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
