oneclick64.jnlp and oneclick32.jnlp client download security issue
Article ID: 261701
Updated On:
Products
Issue/Introduction
When a user goes to download the OC client directly via the browser, the 32-bit client (oneclick.jnlp) prompts for user/password. Hit the same URL with oneclick64.jnlp and the jnlp downloads with no login prompt. This is a security issue. Both 32 and 64-bit should be secured in the same manner.
Steps to reproduce the issue:
$ cd $SPECROOT/tomcat/webapps/spectrum/
$ cp oneclick.jnlp oneclick32.jnlp
$ cp oneclick.jnlp oneclick64.jnlp
In a regular browser:
- http://<OC_hostname>:<port>/spectrum/oneclick.jnlp (requests username and password to download the file)
- http://<OC_hostname>:<port>/spectrum/oneclick32.jnlp (download the file without requesting the username and password)
- http://<OC_hostname>:<port>/spectrum/oneclick64.jnlp (download the file without requesting the username and password)
Environment
Release : 22.2
Cause
The reason it’s not asking for credentials is because this oneclick32.jnlp and oneclick64.jnlp file names are not enclosed within <security-constraint> tag in our web.xml file like it’s done for our regular oneclick.jnlp.
Let me show you how it’s done for oneclick.jnlp file. Open the $SPECROOT/tomcat/webapps/spectrum/WEB-INF/web.xml file you can see that oneclick.jnlp file is enclosed with in <security-constraint> tag, this makes sure that this oneclick.jnlp file is accessed only by Authenticated users.
<security-constraint xmlns="">
<web-resource-collection>
<web-resource-name>SPECTRUM OneClick JNLP file</web-resource-name>
<description>This constraint controls access to the OneClick Start Console JNLP file</description>
<url-pattern>/oneclick.jnlp</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
Resolution
We don’t ship these 32-bit and 64-bit specific jnlp files OOB with Spectrum OC, hence we did not consider adding them to the <security-constraint> tag in web.xml file.
In order to resolve this issue please follow these steps:
1. Take backup of $SPECROOT/tomcat/webapps/spectrum/WEB-INF/web.xml file.
2. Edit this web.xml file and oneclick32.jnlp and oneclick64.jnlp under <security-constraint> tag shown like below:
<security-constraint xmlns="">
<web-resource-collection>
<web-resource-name>SPECTRUM OneClick JNLP file</web-resource-name>
<description>This constraint controls access to the OneClick Start Console JNLP file</description>
<url-pattern>/oneclick.jnlp</url-pattern>
<url-pattern>/oneclick32.jnlp</url-pattern>
<url-pattern>/oneclick64.jnlp</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
3. Restart the Tomcat webserver
- $SPECROOT/tomcat/bin/stopTomcat.sh
- $SPECROOT/tomcat/bin/startTomcat.sh
4. Try to access these 32 and 64-bit jnlp files and they will ask for Authentication before getting downloaded.
Feedback
