Rule:  --Sid:1054--Summary:Someone attempted to gain unauthorized access to web application source codethrough a BEA WebLogic Server or Apache Tomcat JSP vulnerability.--Impact:An attacker may have been able to read the source code to a web application.Sometimes web application source code contains highly sensitive information,such as database passwords and information concerning backend setups.  Thiscould be a prelude to further attacks.--Detailed Information:Some versions of BEA WebLogic and Apache Tomcat web servers containvulnerabilities that can allow an attacker to read the source code toweb applications.--Affected Systems: --Attack Scenarios:Attacker sends a simple URL like the following:http://www.example.com/index.js%70--Ease of Attack:Very simple handcrafted URL.--False Positives:None Known--False Negatives:None Known--Corrective Action:Examine the packet to see if a web request was being done.  Try todetermine what the requested file was, and determinefrom the web server's configuration whether it was a threat or not(e.g., whether the requested file even existed and whether the webserver was vulnerable to such attacks).--Contributors:Original rule writer unknownOriginal document author unkownSourcefire Vulnerability Research TeamNigel Houghton <nigel.houghton@sourcefire.com>--Additional References:--