[ https://issues.apache.org/jira/browse/AXIS2-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12689546#action_12689546 ]
Andreas Veithen commented on AXIS2-4279: ---------------------------------------- Detelin, Your item 2 describes exactly how this is actually supposed to work. The problem is that there is some sort of fallback code that calls getResourceAsStream with a resource name directly taken from the query parameter. I guess this was initially introduced as a hack to solve AXIS2-1556 (even though this actually no longer works). In my opinion the code relying on getResourceAsStream should be removed entirely, but it is a bit difficult to assess the impact of this. > Local File Inclusion Vulnerability on parsing WSDL related XSD Files > -------------------------------------------------------------------- > > Key: AXIS2-4279 > URL: https://issues.apache.org/jira/browse/AXIS2-4279 > Project: Axis 2.0 (Axis2) > Issue Type: Bug > Components: transports > Affects Versions: 1.4.1 > Environment: Tomcat 5.5 > Axis2 1.4.1 > Reporter: Wolfram Kluge > Priority: Blocker > Fix For: 1.5 > > > Hello > i dont know if it is a vulnerability or it is an issue of missconfiguration. > The problem occur by doing the following things, > http://localhost:8080/InsaneService/services/WSInsane?xsd=/../../../WEB-INF/conf/axis2.xml > i was able to get these files displayed by the web browser. Once i tried > this, > furthermore i was also able to get public and private keystore/truststore > located in the WEB-IN dir as well. > So please let me know if it is a missconfiguration, and tell me how i can > configure more securely. > If its a bug please let me also know! > Thank you in advance! > Wolfram -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online.