Exploitation Summary
EIP tracks 2 public exploits for CVE-2016-0793. PoCs published by Tal Solomon of Palantir Security, tafamace.
AI-analyzed exploit summary This exploit describes an information disclosure vulnerability in Wildfly where restricted files in WEB-INF and META-INF directories can be accessed by bypassing filter restrictions using lowercase paths and meaningless characters. The vulnerability affects versions prior to 10.0.0.Final.
Description
Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
Exploits (2)
This exploit describes an information disclosure vulnerability in Wildfly where restricted files in WEB-INF and META-INF directories can be accessed by bypassing filter restrictions using lowercase paths and meaningless characters. The vulnerability affects versions prior to 10.0.0.Final.
The repository contains a minimal Java project with a generic Main.java file that does not demonstrate any exploit functionality related to CVE-2016-0793. The Travis CI configuration suggests it was part of a build pipeline but lacks any exploit-specific code.
References (5)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N