A severe security flaw exists with Allaire's JRun 3.0 allowing an attacker to access WEB-INF directories on the JRun 3.0 server. Details JRun 3.0 can be made to run as a stand-alone web server on port 8100. Each web application directory contains a WEB-INF directory tree which contains configuration files, server side components, libraries and other application related information. This directory is not visible to the client. This causes the entire directory tree under WEB-INF to be displayed and eventually files under this directory can be accessed.
Attackers can also access critical resources such as class files, session information, etc.
We would also like to thank Allaire Inc. for their prompt reaction to this problem and their co-operation in heightening security awareness in the security community. Neither the author nor the publisher accepts any liability whatsoever for any direct, indirect or conquential loss or damage arising in any way from any use of, or reliance placed on, this information for any purpose. This advisory may be redistributed provided that no fee is assigned and that the advisory is not modified in any way.