Executive brief
Caucho Resin is a Java application server that hosts web documentation and tutorials. This vulnerability in the resin-doc documentation webapp allows attackers to read arbitrary files from the server without authentication by exploiting a path traversal flaw in the jndi-appconfig tutorial servlet. An attacker can craft requests to access sensitive system files like /etc/passwd or application configuration files, potentially exposing database credentials, API keys, and other confidential information.
Technical details
The vulnerability is a path traversal flaw in the resin-doc webapp's jndi-appconfig servlet that fails to properly validate the inputFile request parameter, allowing relative path sequences to access files outside the intended tutorial directory. An unauthenticated remote attacker can craft HTTP requests with directory traversal sequences (e.g., /../../../etc/passwd) to read arbitrary files on the system. No authentication or user interaction is required, making this a trivial remote exploitation.
Affected products
- Caucho Resin 3.0.x, 3.1.x and likely later versions with resin-doc enabled
Timeline
- 2017-10-30: disclosed
- 2021-12-10: exploited: Exploitation evidence observed by Shadowserver Foundation