8x8 · Report #1641661
LFI via Jolokia at https://█.█.█.█:1293
Validstatus
mediumseverity
19upvotes
20 Jul 2022disclosed
Summary
@shuvam321 reported to us a single exposed host in the acceptance environment. The report demonstrated a Local File Inclusion via Jolokia, e.g.:
https://█.█.█.█:1293/actuator/jolokia/exec/com.sun.management:type=DiagnosticCommand/compilerDirectivesAdd/!/etc!/hostname
No sensitive information has been disclosed & we swiftly restricted access, which resolved the issue.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.