CVE-2013-3827
published 2013-10-16CVE-2013-3827: Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in…
PriorityP274medium5CVSS 2.0
AVNACLAuNCPINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
32.44%
98.2th percentile
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/costModule/faces/javax.faces.resource/web.xml?loc=../WEB-INF
path/costModule/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
path/faces/javax.faces.resource/web.xml?loc=../WEB-INF
path/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
path/secureader/javax.faces.resource/web.xml?loc=../WEB-INF
path/secureader/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
path/myaccount/javax.faces.resource/web.xml?loc=../WEB-INF
path/myaccount/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
path/SupportPortlet/faces/javax.faces.resource/web.xml?loc=../WEB-INF
path/SupportPortlet/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
path/WEB-INF/web.xml
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Oracle JSF2 Path Traversal Attempt"; flow:established,to_server; http.uri; content:"/WEB-INF/web.xml"; nocase; fast_pattern; http.uri.raw; content:"|2e 2e 2f|"; reference:url,www.synopsys.com/blogs/software-security/path-traversal-defects-oracles-jsf2-implementation.html; reference:cve,2013-3827; classtype:web-application-attack; sid:2017611; rev:5; metadata:created_at 2013_10_17, cve CVE_2013_3827, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)
bytes
|2e 2e 2f|
- →Look for HTTP requests containing the JSF resource handler path segment 'javax.faces.resource' combined with path traversal sequences ('../' or '..') targeting WEB-INF/web.xml. Two distinct traversal patterns exist: (1) dot-dot in the resource path segment itself, and (2) use of the 'ln=..' or 'loc=../WEB-INF' query parameters. ↗
- →The Emerging Threats Snort rule (SID 2017611) detects this attack by matching HTTP URI containing '/WEB-INF/web.xml' (case-insensitive) AND the raw URI containing the URL-encoded '../' sequence (bytes 2e 2e 2f). Deploy or tune this rule on perimeter and internal sensors.
- →The vulnerability exists in Mojarra JSF2 versions 2.0 through 2.1.18 (fixed in 2.1.19). Fingerprint the Mojarra version in server responses or manifests to identify unpatched instances. ↗
- →Shodan/FOFA queries can identify exposed WebLogic instances as potential targets: search for http.title:'weblogic' or body containing 'weblogic application server'.
- ·The nuclei template uses 10 distinct payload paths covering multiple application context roots (costModule, faces, secureader, myaccount, SupportPortlet). Detections scoped only to '/faces/' will miss traversal attempts against other context roots.
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck5.0MEDIUM
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Path Traversal in Eclipse Mojarra
ghsa·2022-05-17
CVE-2013-3827 [MEDIUM] CWE-22 Path Traversal in Eclipse Mojarra
Path Traversal in Eclipse Mojarra
Multiple path traversal flaws where found in Mojarra JSF2 implementation for identifying resources by name or from libraries. An unauthenticated remote attacker can use these flaws to gather otherwise undisclosed information from within an application's root.
OSV
Path Traversal in Eclipse Mojarra
osv·2022-05-17
CVE-2013-3827 [MEDIUM] Path Traversal in Eclipse Mojarra
Path Traversal in Eclipse Mojarra
Multiple path traversal flaws where found in Mojarra JSF2 implementation for identifying resources by name or from libraries. An unauthenticated remote attacker can use these flaws to gather otherwise undisclosed information from within an application's root.
VulnCheck
Oracle GlassFish Server, JDeveloper, and WebLogic Server Components Remote Confidentiality Vulnerability
vulncheck·2013·CVSS 5.0
CVE-2013-3827 [MEDIUM] Oracle GlassFish Server, JDeveloper, and WebLogic Server Components Remote Confidentiality Vulnerability
Oracle GlassFish Server, JDeveloper, and WebLogic Server Components Remote Confidentiality Vulnerability
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.
Affected: Oracle Fusion Middleware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://app.crowdsec.net/cti/cve-explorer/CVE-201
Red Hat
JSF2: Multiple Information Disclosure flaws due to unsafe path traversal
vendor_redhat·2013-10-17·CVSS 5.0
CVE-2013-3827 [MEDIUM] CWE-22 JSF2: Multiple Information Disclosure flaws due to unsafe path traversal
JSF2: Multiple Information Disclosure flaws due to unsafe path traversal
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.
Package: jsf2 (Red Hat JBoss Data Grid 6) - Affected
Package: jsf (Red Hat JBoss Enterprise Application Platform 5) - Not affected
Package: jsf (Red Hat JBoss Enterprise Application Platform 6) - Not affected
Package: jsf2 (Red Hat JBoss Enterprise Application Platform 6) - Not affected
Package
Suricata
ET WEB_SPECIFIC_APPS Oracle JSF2 Path Traversal Attempt
suricata·2013-10-17
CVE-2013-3827 ET WEB_SPECIFIC_APPS Oracle JSF2 Path Traversal Attempt
ET WEB_SPECIFIC_APPS Oracle JSF2 Path Traversal Attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Oracle JSF2 Path Traversal Attempt"; flow:established,to_server; http.uri; content:"/WEB-INF/web.xml"; nocase; fast_pattern; http.uri.raw; content:"|2e 2e 2f|"; reference:url,www.synopsys.com/blogs/software-security/path-traversal-defects-oracles-jsf2-implementation.html; reference:cve,2013-3827; classtype:web-application-attack; sid:2017611; rev:5; metadata:created_at 2013_10_17, cve CVE_2013_3827, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name F
Exploit-DB
Oracle GlassFish Server 2.1.1/3.0.1 - Multiple Subcomponent Resource Identifier Traversal Arbitrary File Access
exploitdb·2013-10-15
CVE-2013-3827 Oracle GlassFish Server 2.1.1/3.0.1 - Multiple Subcomponent Resource Identifier Traversal Arbitrary File Access
Oracle GlassFish Server 2.1.1/3.0.1 - Multiple Subcomponent Resource Identifier Traversal Arbitrary File Access
---
source: https://www.securityfocus.com/bid/63052/info
Oracle JavaServer Faces is prone to multiple directory-traversal vulnerabilities.
Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks.
This vulnerability affects the following products and versions:
WebLogic Server 10.3.6.0, 12.1.1.0
GlassFish Server 2.1.1, 3.0.1, 3.1.2
JDeveloper 11.1.2.3.0, 11.1.2.4.0, 12.1.2.0.0
http://www.example.com/someApp/javax.faces.resource.../WEB-INF/web.xml.jsf
http://www.example.com/someApp/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
Nuclei
Javafaces LFI
nuclei·CVSS 5.0
CVE-2013-3827 [MEDIUM] Javafaces LFI
Javafaces LFI
An Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.
Template:
id: CVE-2013-3827
info:
name: Javafaces LFI
author: Random-Robbie
severity: medium
description: An Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic
HackerOne
https://██████/ Vulnerable to CVE-2013-3827 (Directory-traversal vulnerability)
hackerone·2021-08-26·CVSS 5.0
CVE-2013-3827 [MEDIUM] https://██████/ Vulnerable to CVE-2013-3827 (Directory-traversal vulnerability)
https://██████/ Vulnerable to CVE-2013-3827 (Directory-traversal vulnerability)
**Description:**
Hi team,
https://█████/ using older version of Oracle JavaServer which is vulnerable to CVE-2013-3827.
**POC:**
https://█████/████
## References
https://www.securityfocus.com/bid/63052/info
https://www.exploit-db.com/exploits/38802
## Impact
* Directory-traversal
## System Host(s)
█████
## Affected Product(s) and Version(s)
Oracle JavaServer
## CVE Numbers
CVE-2013-3827
## Steps to Reproduce
Go to https://██████████/██████
## Suggested Mitigation/Remediation Actions
Update your Oracle JavaServer
Bugzilla
CVE-2013-3827 Mojarra JSF2: Multiple Information Disclosure flaws due to unsafe path traversal
bugzilla·2013-12-06·CVSS 5.0
CVE-2013-3827 [MEDIUM] CVE-2013-3827 Mojarra JSF2: Multiple Information Disclosure flaws due to unsafe path traversal
CVE-2013-3827 Mojarra JSF2: Multiple Information Disclosure flaws due to unsafe path traversal
Multiple path traversal flaws where found in Mojarra JSF2 implementation for identifying resources by name or from libraries. An unauthenticated remote attacker can use these flaws to gather otherwise undisclosed information from within an application's root.
References:
[1] http://security.coverity.com/advisory/2013/Oct/two-path-traversal-defects-in-oracles-jsf2-implementation.html
[2] http://www.kb.cert.org/vuls/id/526012
[3] http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
[4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3827
Affects: 2.0 - 2.1.18
Fixed In: 2.1.19
Upstream Fix commit:
https://java.net/projects/mojarra/sources/svn/revision/11603
https://ja
http://rhn.redhat.com/errata/RHSA-2014-0029.htmlhttp://www.kb.cert.org/vuls/id/526012http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.htmlhttp://www.securityfocus.com/bid/63052http://www.securitytracker.com/id/1029190http://rhn.redhat.com/errata/RHSA-2014-0029.htmlhttp://www.kb.cert.org/vuls/id/526012http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.htmlhttp://www.securityfocus.com/bid/63052http://www.securitytracker.com/id/1029190
2013-10-16
Published
Exploited in the wild