PH37483: WITH APPLICATION SECURITY ENABLED, 500 IS RETURNED WHEN HTTP REQUEST HAS MORE REFERENCE TO THE PARENTS/UPPER DIRECTORY

APAR status

• Closed as program error.

Error description

• Request in this case has more reference to the parents/upper
  directory (i.e path traversal ).  For example:
  /abcWeb/..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C
  ..%5C..%5C..%5C..%5C..%5Cwindows%5Cwin.ini/js/jquery-migrate-3.
  3.0.js
  
  (/abcWeb is the context root).
  
  With application security enabled, 500 is returned.
  Without application security enabled, 404 is returned.
  
  There is no functional issue here.  It is mainly about 500 VS
  404 status code. 500 should be used when there has had problem
  in the server.
  
  
  Snippet of the 500 stack:
  [12/21/20 14:53:59:305 HKT] 000000bb webapp        E
  com.ibm.ws.webcontainer.webapp.WebApp logServletError SRVE0293E:
  [Servlet Error]-[ServletNameNotFound]:
  java.lang.IllegalArgumentException: /../../../../../../../../..
  /../../../../../../../windows/win.ini/js/jquery-migrate-3.3.0.js
     at com.ibm.ws.util.WSUtil.resolveURI(WSUtil.java:142)
     at com.ibm.ws.security.web.URLHandler.getServletURI(URLHandl
  er.java:203)
     at com.ibm.ws.security.web.WebCollaborator.authorize(WebColl
  aborator.java:631)
     at com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSW
  ebCollaborator.java:447)
     at com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollab
  oratorImpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230)
     at com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelpe
  r.preInvokeCollaborators(CollaboratorHelper.java:436)
     at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invoke
  Filters(WebAppFilterManager.java:1101)
     at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebAp
  p.java:4219)
  
  
  Security preInvoke() catches an exception from util
  com.ibm.ws.util.WSUtil.resolveURI() and re-throws it with a 500
  request attribute for the error status code.  It should change
  to 404 attribute in this case, so that our sendError() can set
  it accordingly on your behalf.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: When the custom property                *
  *                      ´com.ibm.ws.webcontainer.set400scontoom *
  *                      anyparentdirs´ is enabled, and          *
  *                      application security is also enabled    *
  *                      the following error is seen             *
  *                      ´SRVE0293E´ with a status 500           *
  *                      ´´´[3/18/21 16:27:18:740 HKT]           *
  *                      000000ac webapp        E                *
  *                      com.ibm.ws.webcontainer.webapp.WebApp   *
  *                      logServletError SRVE0293E: [Servlet     *
  *                      Error]-[ServletNameNotFound]:           *
  *                      java.lang.IllegalArgumentException:     *
  *                      /../../../../../../../../../../../../.. *
  *                      /../../../windows/win.ini/PChgPin.actio *
  *                      n´´´                                    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When the custom property
  ´com.ibm.ws.webcontainer.set400scontoom
  anyparentdirs´ is enabled,
  and application security is also
  enabled the following error is seen
  ´SRVE0293E´ with a status 500
  ´´´[3/18/21 16:27:18:740 HKT]
  000000ac webapp        E
  com.ibm.ws.webcontainer.webapp.WebApp
  logServletError SRVE0293E: [Servlet
  Error]-[ServletNameNotFound]:
  java.lang.IllegalArgumentException:
  /../../../../../../../../../../../../..
  /../../../windows/win.ini/PChgPin.actio
  n´´
  

Problem conclusion

• The code was reviewed and improved to throw the correct status
  code when the
  com.ibm.ws.webcontainer.set400scontoomanyparentdirs is enabled.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.21, 9.5.5.10. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP