Bug 778391 (SOA-875) - JSP source code exposure in jmx-console in production setup
Summary: JSP source code exposure in jmx-console in production setup
Keywords:
Status: CLOSED NEXTRELEASE
Alias: SOA-875
Product: JBoss Enterprise SOA Platform 4
Classification: JBoss
Component: Configuration
Version: 4.2 Beta 1
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.2 CP04
Assignee: Julian Coleman
QA Contact:
URL: http://jira.jboss.org/jira/browse/SOA...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-09-26 06:36 UTC by nwallace
Modified: 2009-06-11 20:44 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
[mschoene@mschoene ~]$ uname -a Linux mschoene.csb 2.6.18-8.1.8.el5 #1 SMP Mon Jun 25 17:06:19 EDT 2007 i686 i686 i386 GNU/Linux [mschoene@mschoene ~]$ java -version java version "1.5.0_13" Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_13-b05) Java HotSpot(TM) Server VM (build 1.5.0_13-b05, mixed mode) 13:06:22,418 INFO [Server] Starting JBoss (MX MicroKernel)... 13:06:22,444 INFO [Server] Release ID: JBoss [EAP] 4.3.0.GA (build: SVNTag=JBPAPP_4_3_0_GA date=200712141443) 13:06:22,445 INFO [Server] Home Dir: /NotBackedUp/software/soabeta1/jboss-soa-p.4.2.0/jboss-as 13:06:22,445 INFO [Server] Home URL: file:/NotBackedUp/software/soabeta1/jboss-soa-p.4.2.0/jboss-as/ 13:06:22,446 INFO [Server] Patch URL: null 13:06:22,446 INFO [Server] Server Name: production
Last Closed: 2009-06-11 20:44:33 UTC
Type: Bug

Attachments (Terms of Use)
Screenshot.png (116.45 KB, image/png)
2009-06-11 20:44 UTC, Len DiMaggio 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 777741 0 high CLOSED JSP source code exposure in jmx-console in production setup 2021-02-22 00:41:40 UTC
Red Hat Bugzilla 778642 0 high CLOSED JSP source code exposure in jmx-console in production setup 2021-02-22 00:41:40 UTC
Red Hat Issue Tracker SOA-875 0 None None None Never

Internal Links: 777741 778642

Description nwallace 2008-09-26 06:36:58 UTC 
Complexity: Low
Date of First Response: 2008-10-30 08:14:58
Workaround Description: In SOA production setup use neutral error pages to displaying HTTP 404, 500 errors. 
project_key: SOA

The error page of the jmx-console spits out JSP source code, 
which is not desirable for the SOA production setup as exception 
messages could leak technical data to attackers.  Maybe a more 
general JBAPP problem. 

http://127.0.0.1:8080/jmx-console/DisplayOpResult

HTTP Status 500 -

type Exception report
message

description The server encountered an internal error () that prevented it from fulfilling this request.
exception
org.apache.jasper.JasperException: An exception occurred processing JSP page /displayOpResult.jsp at line 12

9: </head>
10: <body>
11: 
12: <jsp:useBean id='opResultInfo' type='org.jboss.jmx.adaptor.control.OpResultInfo' scope='request'/>
13: 
14: <table width="100%">
15:    <table>


Stacktrace:
	org.apache.jasper.servlet.JspServletWrapper.handleJspException(JspServletWrapper.java:518)
	org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:411)
	org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:320)
	org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266)
	javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
	org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)

root cause

javax.servlet.ServletException: java.lang.InstantiationException: bean opResultInfo not found within scope
	org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:855)
	org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:784)
	org.apache.jsp.displayOpResult_jsp._jspService(displayOpResult_jsp.java:145)
	org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
	javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
	org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:387)
	org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:320)
	org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266)
	javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
	org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)

root cause

java.lang.InstantiationException: bean opResultInfo not found within scope
	org.apache.jsp.displayOpResult_jsp._jspService(displayOpResult_jsp.java:67)
	org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
	javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
	org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:387)
	org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:320)
	org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266)
	javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
	org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)

note The full stack trace of the root cause is available in the JBossWeb/2.0.0.GA_CP05 logs.
Comment 1 nwallace 2008-09-26 06:36:58 UTC 
Link: Added: This issue depends JBPAPP-529
Comment 2 nwallace 2008-09-26 06:37:34 UTC 
Link: Added: This issue is related to SOA-257
Comment 3 nwallace 2008-09-26 06:38:09 UTC 
Can we have confirmation that fixes are in place for 4.2CP03.
Comment 4 Julian Coleman 2008-10-30 12:14:58 UTC 
Needs EAP fix.
Comment 5 nwallace 2009-01-12 08:48:21 UTC 
Link: Added: This issue is related to SOA-1118
Comment 6 Julian Coleman 2009-05-05 11:47:21 UTC 
This is fixed in EAP 4.3.0 CP04, but SOA 4.2.4 still shows the previous (stack trace) behaviour.
Comment 7 Julian Coleman 2009-05-06 13:12:31 UTC 
Fixed with revision 3019 (4.2.0 branch) of:
  build-tools/builders/soa/p-consoles/build.xml
  build-tools/builders/soa/p-consoles/jmx-console/web.xml

Commit message:
  JIRA: SOA-875
  Pull up revision 3017 from trunk.
  
  > JIRA: SOA-257
  > Don't overwrite the EAP JMX console web.xml.
  > We now see the fix for JBPAPP-529 too.
Comment 8 Len DiMaggio 2009-06-11 20:44:12 UTC 
The error no longer shows jsp source - see attached screen shot - in 4.2 CP04 CR4
Comment 9 Len DiMaggio 2009-06-11 20:44:12 UTC 
Attachment: Added: Screenshot.png
Comment 10 Len DiMaggio 2009-06-11 20:44:33 UTC 
The error no longer shows jsp source - see attached screen shot - in 4.2 CP04 CR4
Note You need to log in before you can comment on or make changes to this bug.