COMMAND

	Resin path disclosure using sample scripts

SYSTEMS AFFECTED

	Resin 2.0.5 - 2.1.2

PROBLEM

	Original  Guru   [http://www.security-protocols.com]   found   following
	regarding Resin [http://www.caucho.com] :
	

	While working with Resin, I found that it is possible  to  disclose  the
	physical path to the webroot. An attacker may use  this  information  in
	order to gain unauthorized access to the webserver.
	

	By making a request for:
	

	

	http://target:8080/examples/basic/servlet/HelloServlet

	

	

	Will result in:
	

	Hello, world! The source of this servlet is in:
	

	

	C:\\Documents and Settings\\Administrator\\Desktop\\share\\resin-2.1.1\\doc\\examples\\basic\\WEB-INF\\classes\\HelloServlet.java

	

	

	

SOLUTION

	Remove the /examples directory.