======================================================================= 
IBM WebSphere Arbitrary File Retrieval via "Logging and Tracing"
=======================================================================
   
Affected Software : IBM WebSphere AS 6.1.0.15 and likely other versions
Severity          : Medium
Local/Remote      : Remote
Author            : @_ikki

[Summary]
  
IBM WebSphere is prone to an arbitrary file retrieval vulnerability.
An attacker can exploit this issue by tampering several parameters of
the "Logging and Tracing" module within the administration console.

As the "Logging and Tracing" module can retrieve log files from
registered remote application servers, it is likely possible to disclose
arbitrary files from remote hosts as well.

[Vulnerability Details]
  
The Integrated Solution Console of the application server fails to check
the input parameters used by the "Logging and Tracing" module.

In detail, the following resources seem to be affected:
URL: /ibm/console/jvmLogDetail.do
HTTP POST parameter: runtimeErrFileName

URL: /ibm/console/outputRedirectDetail.do
HTTP POST parameters: stdoutFilename, stderrFilename

An aggressor can easily tamper these parameters in order to retrieve
arbitrary files from the host filesystem as well as from the registered
nodes.

It should be noted that in order to exploit this flaw, an aggressor
needs a valid account for the administration console. A WebSphere
application server administrator may also be a server admin (root),
however this is not strictly necessary. For this reason, the discovered
vulnerability may also allow privileges escalation.

[Time-line]

03/09/2008 - Vendor notified
10/09/2008 - Vendor response
??/??/???? - Vendor patch release
07/01/2011 - Public disclosure (I was cleaning up my filesystem)

  
[Fix Information]

As you can see from the time-line, I'm not aware of any patch provided
by the vendor. Back in 2008, I've been tried to get some updates without
any feedback from IBM. I assume that it was either silently patched or
published without technical details
(http://secunia.com/advisories/33729 ?!)


Cheers,
@_ikki