CVE-2017-1000028
published 2017-07-17CVE-2017-1000028: Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be…
PriorityP183high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
99.48%
99.9th percentile
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | glassfish_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd↗
url/theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/win.ini↗
commandcurl -k --connect-timeout 1 --max-time 1 'https://[target]:4848/resource/gonnados../mkay/done'↗
bytes↗
%c0%af (overlong UTF-8 encoding of forward slash used as path traversal separator)
sigma↗
detection: keywords: - '/theme/META-INF/' AND ('%c0%af' OR '%c0%ae') condition: keywords- →Detect directory traversal attempts against GlassFish admin console by monitoring HTTP GET requests to /theme/META-INF/ containing overlong UTF-8 encoded path separators (%c0%af or %c0%ae) on port 4848. ↗
- →Alert on HTTP 200 responses from GlassFish (port 4848) to /theme/META-INF/ traversal paths where the response body matches 'root:.*:0:0:' (Linux /etc/passwd or /etc/shadow) or contains 'bit app support' and 'fonts' and 'extensions' (Windows win.ini). ↗
- →Detect the DoS variant by monitoring HTTP requests to the /resource/ path on port 4848 where '../' appears but is NOT immediately preceded by '/', which triggers an infinite loop in the normalize() method. ↗
- →Flag Metasploit exploitation attempts: look for the repeating pattern '%c0%af..' (depth 13 repetitions by default) in the URI path targeting /theme/META-INF/prototype on port 4848. ↗
- ·The vulnerability affects GlassFish Server Open Source Edition 4.1 and prior; GlassFish 5.0 and above are NOT vulnerable as they no longer use the jsftemplating package for the admin console. ↗
- ·The admin console listens on port 4848/TCP by default; detections should be scoped to this port to reduce false positives. ↗
- ·Oracle GlassFish Server 3.x (the commercial release) is NOT affected; only the Open Source Edition 4.1 and prior are vulnerable. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w76g-qg26-9xhh: Oracle, GlassFish Server Open Source Edition 4
ghsa_unreviewed·2022-05-14
CVE-2017-1000028 [HIGH] CWE-22 GHSA-w76g-qg26-9xhh: Oracle, GlassFish Server Open Source Edition 4
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.
VulnCheck
Oracle glassfish_server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2017·CVSS 7.5
CVE-2017-1000028 [HIGH] Oracle glassfish_server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Oracle glassfish_server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.
Affected: Oracle glassfish_server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-12&host_type=src&vulnerability=cve-2017-1000028; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-06&host_type=src&vulnerability=cve-2017-100002
No detection rules found.
Exploit-DB
Oracle GlassFish Server Open Source Edition 4.1 - Path Traversal (Metasploit)
exploitdb·2018-08-14
CVE-2017-1000028 Oracle GlassFish Server Open Source Edition 4.1 - Path Traversal (Metasploit)
Oracle GlassFish Server Open Source Edition 4.1 - Path Traversal (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Path Traversal in Oracle GlassFish Server Open Source Edition',
'Description' => %q{
This module exploits an unauthenticated directory traversal vulnerability
which exits in administration console of Oracle GlassFish Server 4.1, which is
listening by default on port 4848/TCP.
},
'References' =>
[
['CVE', '2017-1000028'],
['URL', 'https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-016/?fid=6904'],
['EDB', '39441']
],
'Author' =>
[
'Trustwave SpiderLabs', # Vulnerability discovery
'Dhiraj Mishra' # Metasploit module
],
'Disc
Exploit-DB
Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)
exploitdb·2018-08-14
CVE-2017-1000028 Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)
Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)
---
# Exploit title: Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)
# Author: Dhiraj Mishra
# Date: 2018-08-14
# Software: Oracle Glassfish Server OSE
# Version: 4.1
# Software link: http://download.oracle.com/glassfish/4.1/release/glassfish-4.1.zip
# CVE: 2017-1000028
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Path Traversal in Oracle GlassFish Server Open Source Edition',
'Description' => %q{
This module exploits an unauthenticated directory traversal vulnerability
which exits in administration console of Oracle GlassFish Server 4.1, which is
listening by default on port 4848/TCP.
},
'References' =>
[
['C
Exploit-DB
Oracle GlassFish Server 4.1 - Directory Traversal
exploitdb·2015-08-27
CVE-2017-1000028 Oracle GlassFish Server 4.1 - Directory Traversal
Oracle GlassFish Server 4.1 - Directory Traversal
---
Trustwave SpiderLabs Security Advisory TWSL2015-016:
Path Traversal in Oracle GlassFish Server Open Source Edition
Published: 08/27/2015
Version: 1.0
Vendor: Oracle Corporation (Project sponsored by Oracle)
Product: GlassFish Server Open Source Edition
Version affected: 4.1 and prior versions
Product description:
Built using the GlassFish Server Open Source Edition, Oracle GlassFish
Server delivers a flexible, lightweight and extensible Java EE 6 platform.
It provides a small footprint, fully featured Java EE application server
that is completely supported for commercial deployment and is available as
a standalone offering.
The Administration Console of Oracle GlassFish Server, which is listening
by default on port 4848/TCP, is pr
Nuclei
Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion
nuclei·CVSS 7.5
CVE-2017-1000028 [HIGH] Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion
Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion
Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated local file inclusion vulnerabilities that can be exploited by issuing specially crafted HTTP GET requests.
Template:
id: CVE-2017-1000028
info:
name: Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion
author: pikpikcu,daffainfo
severity: high
description: Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated local file inclusion vulnerabilities that can be exploited by issuing specially crafted HTTP GET requests.
impact: |
Unauthenticated attackers can read arbitrary files including configuration files, database credentials, and sensitive system
Metasploit
Path Traversal in Oracle GlassFish Server Open Source Edition
metasploit
Path Traversal in Oracle GlassFish Server Open Source Edition
Path Traversal in Oracle GlassFish Server Open Source Edition
This module exploits an unauthenticated directory traversal vulnerability which exists in administration console of Oracle GlassFish Server 4.1, which is listening by default on port 4848/TCP.
https://www.exploit-db.com/exploits/45196/https://www.exploit-db.com/exploits/45198/https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-016/?fid=6904https://www.exploit-db.com/exploits/45196/https://www.exploit-db.com/exploits/45198/https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-016/?fid=6904
2017-07-17
Published
Exploited in the wild