Apache JackRabbit 2.0.0 - webapp XPath Injection

# Title: Apache JackRabbit webapp XPath Injection
# Author: ADEO Security
# Published: 11/08/2010
# Version: 2.0.0 (Possible all versions)
# Vendor: http://www.apache.org
# Download: http://www.apache.org/dyn/closer.cgi/jackrabbit/2.0.0/jackrabbit-2.0.0-src.zip

# Description: "Apache Jackrabbit is a fully conforming implementation
of the Content Repository for Java Technology API (JCR, specified in
JSR 170 and 283).
A content repository is a hierarchical content store with support for
structured and unstructured content, full text search, versioning,
transactions, observation, and more.
Apache Jackrabbit is a project of the Apache Software Foundation."

# Credit: Vulnerability founded by Canberk BOLAT
        - Mail: canberk.bolat[AT]adeo.com.tr
        - Web: http://security.adeo.com.tr

# Vulnerability:
In search.jsp file HTTP GET parameter "q" included to XPath query
without sanitised if its start with word "related:".

search.jsp
...
String q = request.getParameter("q");
...
       if (q != null && q.length() > 0) {
            String stmt;
            if (q.startsWith("related:")) {
                String path = q.substring("related:".length());
                stmt = "//element(*, nt:file)[rep:similar(jcr:content,
'" + path + "/jcr:content')]/rep:excerpt(.) order by @jcr:score
descending";
                queryTerms = "similar to <b>" +
Text.encodeIllegalXMLCharacters(path) + "</b>";
            }
...