[
https://issues.apache.org/jira/browse/FELIX-6854?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101393#comment-18101393
]
Carsten Ziegeler commented on FELIX-6854:
-----------------------------------------
First one is to check whether one can break out of that sub directory by path
traversal - if yes, we need to fix.
If not, second thing would be to check whether the prefix is enough.
> AbstractServlet.spoolResource delivers arbitrary files visible to classloader
> -----------------------------------------------------------------------------
>
> Key: FELIX-6854
> URL: https://issues.apache.org/jira/browse/FELIX-6854
> Project: Felix
> Issue Type: Bug
> Components: Web Console
> Affects Versions: webconsole-5.0.18
> Reporter: Konrad Windszus
> Priority: Major
>
> There is no limitation on resource names in
> https://github.com/apache/felix-dev/blob/762b769b60b41e139fce4a3c1b2c0bb1b2569155/webconsole/src/main/java/org/apache/felix/webconsole/servlet/AbstractServlet.java#L127
> which allows to expose arbitrary class files via the Felix WebConsole.
> Only the underlying bundle classloader may limit visibility.
> Although usually only admin like users have access to the Felix WebConsole,
> exposing all classloader resources unnecessarily may leak sensitive
> information.
> Would be best if each web console plugin maintains an allow list which
> resources may be requested but this would probably require a non backwards
> compatible fix.
> The same issue occurs in the deprecated AbstractWebConsolePlugin
> (https://github.com/apache/felix-dev/blob/762b769b60b41e139fce4a3c1b2c0bb1b2569155/webconsole/src/main/java/org/apache/felix/webconsole/AbstractWebConsolePlugin.java#L483).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
