PR08-09: Unauthenticated File Retrieval on Sun Java System Identity Manager "ext" parameter Date Found: 25th April 2008 Vendor Contacted: 28th April 2008 Date Public: 10th November 2008 Severity: High Credits: Richard Brain of ProCheckUp Ltd (www.procheckup.com). ProCheckUp thanks Sun for working with us. Description: Sun Java System Identity Manager is vulnerable to *unauthenticated* file retrieval a.k.a. directory traversal within the "ext" parameter processed by the "/idm/includes/helpServer.jsp" server-side script. Consequences: Any files can be retrieved from the target server provided that the attacker knows its location on the filesystem. No authentication is required to exploit this vulnerability. Proof of concept (PoC): _Due to the severity of this issue, ProCheckUp will keep the PoC private until all Sun Identity Manager customers are given enough time to update._ Successfully tested on: Server environment: Windows Server 2003, Standard Apache Tomcat/5.0.28 Sun Java System Identity Manager 6.0 (20061212 SP 2) Note: the version of Sun Java SIM can be obtained from the HTML source code of the user login page: "/idm/user/login.jsp" i.e.: [snip]