CVE-2017-1000028

This Metasploit module exploits an unauthenticated directory traversal vulnerability in Oracle GlassFish Server 4.1 by sending a crafted HTTP GET request to read arbitrary files. The exploit uses a traversal string with encoded characters to bypass path restrictions.

This exploit demonstrates a path traversal vulnerability in Oracle GlassFish Server Open Source Edition 4.1 and prior. It uses URL-encoded directory traversal sequences (%c0%af..) to access sensitive files like win.ini and /etc/shadow.

This Metasploit module exploits an unauthenticated path traversal vulnerability in Oracle GlassFish Server 4.1 via a crafted URI to read arbitrary files. It uses a double-encoded traversal sequence to bypass security checks.

This repository contains a functional Python exploit for CVE-2017-1000028, a directory traversal vulnerability in GlassFish versions prior to 4.1.1. The exploit leverages a path traversal technique using URL-encoded characters to read arbitrary files, such as /etc/passwd, from the target system.

This Metasploit module exploits an unauthenticated directory traversal vulnerability in Oracle GlassFish Server 4.1 via a crafted HTTP GET request to the administration console. It reads arbitrary files by leveraging a path traversal technique with encoded characters.