CVE-2017-20284: Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet
Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests with directory traversal sequences to the servlet endpoint to read files outside the intended tutorial directory on the underlying system. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-12-10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Limit network access to the Caucho Resin documentation webapp (resin-doc) / jndi-appconfig tutorial servlet so remote unauthenticated users cannot reach the servlet endpoint.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication, privileges, or user interaction are required. The attack can be performed remotely against an accessible affected servlet endpoint.
Which deployments are exposed?
Deployments that include the resin-doc documentation webapp and expose the jndi-appconfig tutorial servlet are affected. The vulnerable input is the inputFile request parameter.
How can attempted exploitation be identified?
Review requests to the jndi-appconfig tutorial servlet for inputFile values containing relative-path or directory-traversal sequences. Such requests may be attempts to access files outside the intended tutorial directory.
Is there evidence that this issue has been exploited?
Exploitation evidence was first observed by the Shadowserver Foundation on 2021-12-10.