Synopsis
While developing a Nessus plugin for CVE-2017-1000028, Tenable found a new remote unauthenticated denial of service vulnerability in GlassFish 4.1.2 and below. The vulnerability is a result of an infinite loop in the normalize() method in com.sun.jsftemplating.util.fileStreamer.ResourceContentSource. A patch for the infinite loop was published in early April.
The jsftemplating package is used by the GlassFish 4.1.2 admin console. In order to trigger the the infinite loop an unauthenticated remote attacker simply needs to create an HTTP request where "../" appears but is not immediately preceded by a "/". For example:
curl -k --connect-timeout 1 --max-time 1 'https://[target]:4848/resource/gonnados../mkay/done'
Tenable did not find GlassFish 5.0 and above to be vulnerable to this attack since they no longer use the jsftemplating package for the admin console. None the less, the GlassFish master branch did pull in the fixed version of jsftemplating in late April.
Solution
Currently there is no solution for this vulnerability in GlassFish 4.1.2 and below.Additional References
https://github.com/javaee/jsftemplating/commit/4679f00e97b0b7f62b111debcd87115f39570ce6https://github.com/javaee/glassfish/commit/6ee1befbf4a7b224a2e1f247f989653af3b97e32
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team