JRun 3.0 can be made to run as a stand-alone web server on port 8100. Each web application directory contains a WEB-INF directory tree that contains configuration files, server side components, libraries and other application related information. This directory is not visible to the client. The server responds with a 403 Forbidden error code. This causes the entire directory tree under WEB-INF to be displayed and eventually files under this directory can be accessed.
Attackers can also access critical resources such as class files, session information, etc.
The information has been provided by Shreeraj Shah , Saumil Shah and Stuart McClure . . Security Ltd. All rights reserved. Terms of Use Site Privacy Statement .