PageContext.forward vulnerability?

Question

Hi everybody,
I've a problem in using the pageContext.forward() function with parameters.
Suppose to have such source code in a jsp page:
<%
String ATTACH = "../../WEB-INF/classes/myclass.class";
if (true) {
     pageContext.forward("/example.jsp?ID=" + ATTACH);
     return;
%>Changing the page example.jsp with any other existing page and the parameter ID with any other parameter
name the result doesn't change: the server (in my configuration Tomcat 5.5.9) sends the client the byte-code
of myclass.class! In fact the page example.jsp is never called! Is this correct?
Thanks,
Loris

Answer 1

Tomcat Security Team recognized this issue as an important vulnerability that affects Tomcat 4.x, 5.x, 6.x.
Here are the references:
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2370
http://tomcat.apache.org/security-6.html
Information disclosure - CVE-2008-2370
When using a RequestDispatcher the target path was normalised before the query string was removed. A request that included a specially crafted request parameter could be used to access content that would otherwise be protected by a security constraint or by locating it in under the WEB-INF directory.
Thanks,
Loris