[ https://issues.apache.org/jira/browse/JSPWIKI-846?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Harry Metske resolved JSPWIKI-846. ---------------------------------- Resolution: Not a Problem > Potential Command Execution from Wiki.jsp & rss.jsp > --------------------------------------------------- > > Key: JSPWIKI-846 > URL: https://issues.apache.org/jira/browse/JSPWIKI-846 > Project: JSPWiki > Issue Type: Bug > Affects Versions: 2.10.1 > Reporter: Jeff LoBello > > Nessus reported the following potential vulnerability... > Date: Fri 13 Jun 2014 15:29:51 MET > Vuln#: 3CN39465 (counted) > Vulnerability: CGI Generic Command Execution > ToDo: Restrict access to the vulnerable application. Contact thevendor for a > patch or upgrade. > CertRef: > Tool Reference: http://www.nessus.org/plugins/index.php?view=single&id=39465 > Comment: > NessusOutput: > Port: 80/tcp > Using the GET HTTP method, Nessus found that : > + The following resources may be vulnerable to arbitrary command execution : > + The 'page' parameter of the /wiki/Wiki.jsp CGI : > /wiki/Wiki.jsp?page=echo%20NeS%20%20SuS > -------- output -------- > <meta name="wikiBaseUrl" content='http://165.226.163.94/wiki/' > /> <meta name="wikiPageUrl" > content='/wiki/Wiki.jsp?page=%23%24%25' /> <meta > name="wikiEditUrl" content='/wiki/Edit.jsp?page=Echo%20NeS%20SuS' > /> > <meta name="wikiJsonUrl" content='/wiki/JSON-RPC' /> <meta > name="wikiPageName" content='Echo NeS SuS' /> > ------------------------ > + The 'page' parameter of the /wiki/rss.jsp CGI : > /wiki/rss.jsp?page=echo%20NeS%20%20SuS > -------- output -------- > Error 404: No such page Echo NeS SuS > ------------------------ > Clicking directly on these URLs should exhibit the issue : > (you will probably need to read the HTML source) > http://165.226.163.94/wiki/Wiki.jsp?page=echo%20NeS%20%20SuS > http://165.226.163.94/wiki/rss.jsp?page=echo%20NeS%20%20SuS > I believe this is a false positive. I did not see evidence of arbitrary > command injection, but nonetheless, I wanted to pass on the finding for your > analysis. -- This message was sent by Atlassian JIRA (v6.2#6252)