File Inclusion Vulnerability

The value of the userDirectory variable used when calling workingCopy.action is not filtered properly. This gives anyone who can access workingCopy.action the ability to read any file on the file system with the permissions that jetty is running as.

For example, let's say we have continuum installed in /usr/local/continuum. Say we have a project named build-tools with a projectId of 10. Using the following URL, I can display the contents of /proc/version (see attached screenshot).

http://some-server.domain.com:8080/continuum/workingCopy.action?projectId=10&projectName=build-tools&userDirectory=../../../../../../../../../proc/&file=version

This is really bad if the user is running continuum as root because it gives the attacker access to every file on the file system.