Public Health Research Grid / Bugs / #8 Secure Transfer Service security issue

#8 Secure Transfer Service security issue

Status: open

Owner: nobody

Labels: Service (3)

Priority: 1

Updated: 2009-09-16

Created: 2009-02-09

Private: No

The service allows users to download data outside of the /simpleTransfer directory. The service can reach all directories on the file system.

Discussion

Daniel Washington - 2009-02-09

java -jar caGrid-Transfer-client-1.0.jar ../<directory> can be used to traverse the entire file system.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Brian Lee - 2009-03-04

assigned_to: nobody --> frosemond
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Brian Lee - 2009-03-04

Dan's example will work on any file that the user running Tomcat/Globus can access. So it can't actually retrieve the entire file system, only what the user is allowed to access (kind of like GridFTP's controls).

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Brian Lee - 2009-09-16

priority: 3 --> 1
If you would like to refer to this comment somewhere else in this project, copy and paste the following link: