CVE-2017-1000028

HIGH EXPLOITED NUCLEI

Oracle GlassFish Server Open Source Edition 4.1 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2017-1000028 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 5 public exploits from researchers including Metasploit, Trustwave's SpiderLabs, Dhiraj Mishra, including a Metasploit module auxiliary/scanner/http/glassfish_traversal. A Nuclei detection template is also available.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated directory traversal vulnerability in Oracle GlassFish Server 4.1 by sending a crafted HTTP GET request to read arbitrary files. The exploit uses a traversal string with encoded characters to bypass path restrictions.

Description

Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.

Exploits (5)

exploitdb WORKING POC VERIFIED
by Metasploit · rubywebappswindows
https://www.exploit-db.com/exploits/45196

This Metasploit module exploits an unauthenticated directory traversal vulnerability in Oracle GlassFish Server 4.1 by sending a crafted HTTP GET request to read arbitrary files. The exploit uses a traversal string with encoded characters to bypass path restrictions.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Oracle GlassFish Server 4.1
No auth needed
Prerequisites: Network access to the GlassFish administration console (default port 4848)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Trustwave's SpiderLabs · textwebappsmultiple
https://www.exploit-db.com/exploits/39441

This exploit demonstrates a path traversal vulnerability in Oracle GlassFish Server Open Source Edition 4.1 and prior. It uses URL-encoded directory traversal sequences (%c0%af..) to access sensitive files like win.ini and /etc/shadow.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Oracle GlassFish Server Open Source Edition 4.1 and prior
Auth required
Prerequisites: Authenticated access to the GlassFish administration console
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Dhiraj Mishra · rubywebappslinux
https://www.exploit-db.com/exploits/45198

This Metasploit module exploits an unauthenticated path traversal vulnerability in Oracle GlassFish Server 4.1 via a crafted URI to read arbitrary files. It uses a double-encoded traversal sequence to bypass security checks.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Oracle GlassFish Server Open Source Edition 4.1
No auth needed
Prerequisites: Network access to port 4848/TCP
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by NeonNOXX · infoleak
https://github.com/NeonNOXX/CVE-2017-1000028

This repository contains a functional Python exploit for CVE-2017-1000028, a directory traversal vulnerability in GlassFish versions prior to 4.1.1. The exploit leverages a path traversal technique using URL-encoded characters to read arbitrary files, such as /etc/passwd, from the target system.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: GlassFish < 4.1.1
No auth needed
Prerequisites: Network access to the GlassFish administration interface (typically port 4848)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC
by Trustwave SpiderLabs, Dhiraj Mishra · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/glassfish_traversal.rb

This Metasploit module exploits an unauthenticated directory traversal vulnerability in Oracle GlassFish Server 4.1 via a crafted HTTP GET request to the administration console. It reads arbitrary files by leveraging a path traversal technique with encoded characters.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Oracle GlassFish Server Open Source Edition 4.1
No auth needed
Prerequisites: Network access to the GlassFish administration console (default port 4848)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion
HIGHby pikpikcu,daffainfo
Shodan: cpe:"cpe:2.3:a:oracle:glassfish_server"

References (3)

Core 3
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45198/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45196/
Exploit, Mailing List, Third Party Advisory x_refsource_misc
https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-016/?fid=6904

Scores

CVSS v3 7.5
EPSS 0.9412
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

VulnCheck KEV 2023-12-12
CWE
CWE-22
Status published
Products (1)
oracle/glassfish_server 4.1
Published Jul 17, 2017
Tracked Since Feb 18, 2026