CVE-2016-0793: Infoleak
An information disclosure of the content of restricted files WEB-INF and META-INF via filter mechanism was reported. Servlet filter restriction mechanism is enforced by two code checks:
if (path.startsWith("/META-INF") || path.startsWith("META-INF") || path.startsWith("/WEB-INF") || path.startsWith("WEB-INF")) { return false; }
private boolean isForbiddenPath(String path) { return path.equalsIgnoreCase("/meta-inf/") || path.regionMatches(true, 0, "/web-inf/", 0, "/web-inf/".length()); }
which can be bypassed using lower case and adding meaningless character to path.
Other sources
Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0793?
CVE-2016-0793 is classified as a medium severity vulnerability due to the potential information disclosure of restricted file contents.
How do I fix CVE-2016-0793?
To mitigate CVE-2016-0793, users should upgrade to a patched version of Red Hat JBoss WildFly Application Server.
What types of files are affected by CVE-2016-0793?
CVE-2016-0793 specifically exposes the contents of restricted files located in the WEB-INF and META-INF directories.
Which versions of Red Hat JBoss WildFly are vulnerable to CVE-2016-0793?
CVE-2016-0793 affects version 10.0.0 of Red Hat JBoss WildFly Application Server.
Is Microsoft Windows affected by CVE-2016-0793?
No, Microsoft Windows itself is not affected by CVE-2016-0793.