Issue Details (XML | Word | Printable)

Key: LUTECE-1136
Type: Bug Bug
Status: Open Open
Priority: Critical Critical
Assignee: ILE
Reporter: Nicolas Gregoire
Votes: 0
Watchers: 1
Operations

If you were logged in you would be able to see more operations.
Lutèce

Contributors and admins can execute arbitrary commands on the underlying server

Created: 03/Feb/10 03:56 PM   Updated: 08/Feb/10 09:31 AM
Component/s: core
Affects Version/s: 2.3.3
Fix Version/s: 2.4.0

Time Tracking:
Not Specified

Environment: The issue isn't specific to any OS or software platform


 Description  « Hide

Contributors and admins can upload some new page templates. These templates can contain Java code which will be executed by the server when requested via a browser.

In "Gestion des modèles de page", click on "Ajouter". You'll reach the page "Fiche de création d'un modèle de page". Here, select the JSP file that you want to upload (for example "cmdjsp.jsp" from http://michaeldaw.org/projects/wbc-v1b.tar.gz) in field "Image " and fill the two others fields. After validation, the uploaded JSP file is reachable at /images/admin/page_templates/cmdjsp.jsp.

The following URL will display the result of the "ipconfig" command :
/images/admin/page_templates/cmdjsp.jsp?cmd=ipconfig

Impact is large mainly when Lutece is deployed on some shared/hosted servers where Lutece contributors haven't sysadmins privileges.



There are no comments yet on this issue.