CVE-2014-7816
published 2014-12-01CVE-2014-7816: Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows…
PriorityP345medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
25.08%
97.7th percentile
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | undertow | — | — |
| redhat | undertow | <= 1.0.16 | — |
| redhat | undertow | <= 1.1.0 | — |
| redhat | undertow | <= 1.2.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for HTTP requests containing '..' (dot dot) sequences in the URI path targeting JBoss Undertow / WildFly on port 8080 on Windows hosts — this is the directory traversal vector for CVE-2014-7816. ↗
- →The Metasploit auxiliary module `scanner/http/wildfly_traversal` can be used to detect vulnerable WildFly 8.1.0.Final instances; monitor for its characteristic scan traffic against port 8080. ↗
- ·CVE-2014-7816 is Windows-only. The directory traversal only works because '\' is a path delimiter on Windows; Linux/Unix systems are not affected as encoded and UTF-8 '../' variants are caught by the server. ↗
- ·Red Hat products are explicitly stated as not vulnerable, so detection efforts should focus on non-Red Hat deployments of JBoss Undertow 1.0.x < 1.0.17, 1.1.x < 1.1.0.CR5, and 1.2.x < 1.2.0.Beta3 on Windows. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Undertow: Information disclosure via directory traversal
vendor_redhat·2014-10-28·CVSS 5.0
CVE-2014-7816 [MEDIUM] CWE-20 Undertow: Information disclosure via directory traversal
Undertow: Information disclosure via directory traversal
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
It was discovered that Undertow is vulnerable to a directory traversal flaw. A remote attacker could use this flaw to read arbitrary files that are accessible to the user running the Java process.
Statement: Not vulnerable. This issue does not affect any Red Hat product.
Debian
CVE-2014-7816: undertow - Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x b...
vendor_debian·2014·CVSS 5.0
CVE-2014-7816 [MEDIUM] CVE-2014-7816: undertow - Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x b...
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
Scope: local
forky: resolved
sid: resolved
OSV
Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow
osv·2022-05-17
CVE-2014-7816 [MEDIUM] Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow
Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
GHSA
Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow
ghsa·2022-05-17
CVE-2014-7816 [MEDIUM] CWE-22 Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow
Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
No detection rules found.
Exploit-DB
Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution
exploitdb·2015-08-17
CVE-2016-3088 Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution
Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution
---
I have recently been playing with Apache ActiveMQ, and came across a simple but interesting directory traversal flaw in the fileserver upload/download functionality.
I have only been able to reproduce this on Windows, i.e. where "\" is a path delimiter.
An attacker could use this flaw to upload arbitrary files to the server, including a JSP shell, leading to remote code execution.
Exploiting Windows systems to achieve RCE The default conf/jetty.xml includes:
Effectively blocking the upload of JSP files into contexts that will allow them to execute.
I imagine there are many ways around this; for my proof of concept I opted to overwrite conf/jetty-realm.properties and set my own credentials:
$ cat jetty-rea
Metasploit
WildFly Directory Traversal
metasploit
WildFly Directory Traversal
WildFly Directory Traversal
This module exploits a directory traversal vulnerability found in the WildFly 8.1.0.Final web server running on port 8080, named JBoss Undertow. The vulnerability only affects to Windows systems.
Bugzilla
CVE-2014-7816 wildfly: Undertow: Information disclosure via directory traversal [fedora-all]
bugzilla·2014-10-31·CVSS 5.0
CVE-2014-7816 [MEDIUM] CVE-2014-7816 wildfly: Undertow: Information disclosure via directory traversal [fedora-all]
CVE-2014-7816 wildfly: Undertow: Information disclosure via directory traversal [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple support
Bugzilla
CVE-2014-7816 Undertow: Information disclosure via directory traversal
bugzilla·2014-10-27·CVSS 5.0
CVE-2014-7816 [MEDIUM] CVE-2014-7816 Undertow: Information disclosure via directory traversal
CVE-2014-7816 Undertow: Information disclosure via directory traversal
IssueDescription:
It was discovered that Undertow, when running on Microsoft Windows, is vulnerable to a directory traversal flaw. A remote attacker could use this flaw to read arbitrary files that are accessible to the user running the Java process.
Discussion:
Statement:
Not vulnerable. This issue does not affect any Red Hat product.
---
Upstream Issue:
https://issues.jboss.org/browse/WFLY-4020
https://issues.jboss.org/browse/UNDERTOW-338
---
Acknowledgements:
Red Hat would like to thank Roberto Soares of Conviso Application Security for reporting this issue.
---
It was confirmed that this issue only affects Undertow if running on Windows platform.
---
Created wildfly tracking bugs for this issue:
Affe
http://seclists.org/oss-sec/2014/q4/830http://www.securityfocus.com/bid/71328https://bugzilla.redhat.com/show_bug.cgi?id=1157478https://issues.jboss.org/browse/UNDERTOW-338https://issues.jboss.org/browse/WFLY-4020http://seclists.org/oss-sec/2014/q4/830http://www.securityfocus.com/bid/71328https://bugzilla.redhat.com/show_bug.cgi?id=1157478https://issues.jboss.org/browse/UNDERTOW-338https://issues.jboss.org/browse/WFLY-4020
2014-12-01
Published