CVE-2016-0709
published 2016-04-11CVE-2016-0709: Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated…
PriorityP268high7.2CVSS 3.0
AVNACLPRHUINSUCHIHAH
EXPLOIT
EPSS
77.50%
99.5th percentile
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | jetspeed | <= 2.3.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect POST requests to the unauthenticated User Manager REST API endpoint used to create rogue admin accounts prior to exploitation. ↗
- →Alert on multipart/form-data POST to the Import/Export portal admin page containing a ZIP file with path traversal sequences (e.g., '../..') in archive entry names. ↗
- →Monitor for ZIP archive uploads where entries contain '..' sequences, particularly targeting webapps directories (e.g., '../../webapps/jetspeed/*.jsp'). ↗
- →Detect POST to /jetspeed/services/usermanager/users with role assignment to 'admin' as a precursor step in the exploit chain. ↗
- →Watch for newly created .jsp files appearing under the Jetspeed webapps directory following a ZIP import operation, indicating successful path traversal write. ↗
- ·The exploit targets Apache Jetspeed 2.3.0 and potentially unknown earlier versions; the fix is present only in 2.3.1 and later. ↗
- ·Exploitation requires remote authenticated administrator credentials; the Metasploit module first creates a new admin user via the unsecured REST API (CVE-2016-0710) before leveraging the path traversal (CVE-2016-0709). ↗
- ·Successful exploitation of the file upload has been observed to permanently corrupt the Jetspeed web interface with no known workaround. ↗
CVSS provenance
nvdv3.07.2HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Path Traversal in Apache Jetspeed
osv·2022-05-17
CVE-2016-0709 [HIGH] Path Traversal in Apache Jetspeed
Path Traversal in Apache Jetspeed
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."
GHSA
Path Traversal in Apache Jetspeed
ghsa·2022-05-17
CVE-2016-0709 [HIGH] CWE-22 Path Traversal in Apache Jetspeed
Path Traversal in Apache Jetspeed
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."
No detection rules found.
Exploit-DB
Apache Jetspeed - Arbitrary File Upload (Metasploit)
exploitdb·2016-03-31·CVSS 7.2
CVE-2016-0710 [HIGH] Apache Jetspeed - Arbitrary File Upload (Metasploit)
Apache Jetspeed - Arbitrary File Upload (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Apache Jetspeed Arbitrary File Upload',
'Description' => %q{
This module exploits the unsecured User Manager REST API and a ZIP file
path traversal in Apache Jetspeed-2, versions 2.3.0 and unknown earlier
versions, to upload and execute a shell.
Note: this exploit will create, use, and then delete a new admin user.
Warning: in testing, exploiting the file upload clobbered the web
interface beyond repair. No workaround has been found yet. Use this
module at your own risk. No check will be implemented.
},
'Author' => [
'Andreas Lindh', # Vulnerability discovery
'wvu' # Met
Metasploit
Apache Jetspeed Arbitrary File Upload
metasploit
Apache Jetspeed Arbitrary File Upload
Apache Jetspeed Arbitrary File Upload
This module exploits the unsecured User Manager REST API and a ZIP file path traversal in Apache Jetspeed-2, version 2.3.0 and unknown earlier versions, to upload and execute a shell. Note: this exploit will create, use, and then delete a new admin user. Warning: in testing, exploiting the file upload clobbered the web interface beyond repair. No workaround has been found yet. Use this module at your own risk. No check will be implemented.
No writeups or analysis indexed.
http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-andhttp://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.htmlhttp://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_uploadhttps://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C281D02D0-6A03-4421-9D86-E73B001C8677%40bluesunrise.com%3Ehttps://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0709https://www.exploit-db.com/exploits/39643/http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-andhttp://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.htmlhttp://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_uploadhttps://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C281D02D0-6A03-4421-9D86-E73B001C8677%40bluesunrise.com%3Ehttps://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0709https://www.exploit-db.com/exploits/39643/
2016-04-11
Published