[Geoserver-devel] [JIRA] (GEOS-8252) Security issue - access any local server file from wep interface

[_Failed_to_Retrieve]

Alexey Vlasov created an issue

GeoServer / GEOS-8252

Security issue - access any local server file from wep interface

Issue Type:	Bug
Affects Versions:	2.7.2
Assignee:	Unassigned
Created:	11/Aug/17 3:05 PM
Priority:	Medium
Reporter:	Alexey Vlasov

Login to Geoserver web panel 2 Go to Settings - Global Change logging profile to QUITE_LOGGING.properties Change log location: replace “logs/geoserver.log” to “/etc/passwd” Go to Geoserver Logs Result: you will see “/etc/passwd” (and even download whole file by link below log text) So it’s possible to read and display any local file from server with only geoserver web interface

Add Comment

Get JIRA notifications on your phone! Download the JIRA Cloud app for Android or iOS

This message was sent by Atlassian JIRA (v1000.1169.1#100058-sha1:a86f419)