Hi,

uPortal ships an HttpProxyServlet which is enabled by default.

This servlet accepts requests of the form '/host/url' and will relay
information from *any* host named in the request, including query
string.

The only security I see is to check that the requests 'Referer' header
is that of the portal.  This is trivial to subvert, as HTTP headers are
easy to forge ( http://livehttpheaders.mozdev.org/ ).

This means that anyone who can connect to this servlet (normally the
whole world) is capable of requesting any document from any machine
which the uPortal machine can itself access (possibly including machines
on your intranet or behind your firewall).  This could be used to
retrieve sensitive information or forward requests containing any number
of remote exploit attempts.

Or am I missing something?

-- 
Chris Hubick
mailto:[EMAIL PROTECTED]



__ 
    This communication is intended for the use of the recipient to whom it
    is addressed, and may contain confidential, personal, and or privileged
    information. Please contact us immediately if you are not the intended
    recipient of this communication, and do not copy, distribute, or take
    action relying on it. Any communications received in error, or
    subsequent reply, should be deleted or destroyed.
---

-- 
You are currently subscribed to [email protected] as: [EMAIL 
PROTECTED]
To unsubscribe, change settings or access archives, see 
http://www.ja-sig.org/wiki/display/JSG/uportal-dev

Reply via email to