CVE-2011-0807
published 2011-04-20CVE-2011-0807: Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers…
PriorityP273critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
60.88%
99.0th percentile
Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | glassfish_server | — | — |
| oracle | glassfish_server | — | — |
| oracle | glassfish_server | — | — |
| sun | java_system_application_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Authentication bypass is achieved by sending lowercase HTTP verbs (e.g., 'get' instead of 'GET') to the GlassFish admin interface on port 4848. Detect anomalous lowercase HTTP methods in requests to GlassFish admin paths. ↗
- →Exploitation involves deploying a malicious WAR file via the GlassFish admin console upload endpoint. Monitor for WAR file uploads to /applications/upload.jsf or /common/applications/uploadFrame.jsf on port 4848. ↗
- →After WAR deployment, the exploit accesses the deployed JSP payload via port 8080 (APP_RPORT). Monitor for suspicious JSP execution requests on the application port following admin activity on port 4848. ↗
- →The exploit checks for successful authentication by matching 'Deploy Enterprise Applications/Modules' or 'Deploy Applications or Modules' in the response body. These strings in HTTP responses to upload paths indicate active admin session establishment. ↗
- →GlassFish 4.0 requires HTTPS with TLS1 and Secure Admin enabled for remote DAS access. Exploitation attempts against older versions may appear over plain HTTP on port 4848. ↗
- →Server banner fingerprinting is used to identify vulnerable GlassFish versions. Monitor for requests that elicit Server headers matching 'Sun GlassFish Enterprise Server', 'Sun Java System Application Server', or 'Open Source Edition' patterns. ↗
- ·Default credentials for GlassFish 2.x and Sun Java System Application Server 9.x are admin/adminadmin; for GlassFish 3.x the default is admin with an empty password. These are tried before the auth bypass. ↗
- ·Newer GlassFish versions do not allow remote access (Secure Admin) by default, limiting exploitability to instances where Secure Admin has been explicitly enabled. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Sun/Oracle GlassFish Server - (Authenticated) Code Execution (Metasploit)
exploitdb·2011-08-05
CVE-2011-0807 Sun/Oracle GlassFish Server - (Authenticated) Code Execution (Metasploit)
Sun/Oracle GlassFish Server - (Authenticated) Code Execution (Metasploit)
---
##
# $Id: glassfish_deployer.rb 13485 2011-08-04 17:36:01Z hdm $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "Sun/Oracle GlassFish Server Authenticated Code Execution",
'Description' => %q{
This module logs in to an GlassFish Server 3.1 (Open Source or Commercial)
instance using a default credential, uploads, and executes commands via deploying
a malicious WAR. On Glassfish 2.x, 3.0 and Sun Java System Application Server 9.x
this module will try to bypass authe
Metasploit
Sun/Oracle GlassFish Server Authenticated Code Execution
metasploit
Sun/Oracle GlassFish Server Authenticated Code Execution
Sun/Oracle GlassFish Server Authenticated Code Execution
This module logs in to a GlassFish Server (Open Source or Commercial) using various methods (such as authentication bypass, default credentials, or user-supplied login), and deploys a malicious war file in order to get remote code execution. It has been tested on Glassfish 2.x, 3.0, 4.0 and Sun Java System Application Server 9.x. Newer GlassFish versions do not allow remote access (Secure Admin) by default, but is required for exploitation.
Metasploit
GlassFish Brute Force Utility
metasploit
GlassFish Brute Force Utility
GlassFish Brute Force Utility
This module attempts to login to GlassFish instance using username and password combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options. It will also try to do an authentication bypass against older versions of GlassFish. Note: by default, GlassFish 4.0 requires HTTPS, which means you must set the SSL option to true, and SSLVersion to TLS1. It also needs Secure Admin to access the DAS remotely.
No writeups or analysis indexed.
2011-04-20
Published