CVE-2018-1047

MEDIUM

JBoss WildFly Application Server 9.x - Path Traversal via ServletResourceManager

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-1047. PoCs published by shoucheng3.

AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2018-1047, a vulnerability in WildFly Application Server. The exploit targets a deserialization flaw in the appclient module, allowing remote code execution.

Description

A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.

Exploits (1)

nomisec WORKING POC

by shoucheng3 · poc

https://github.com/shoucheng3/wildfly__wildfly_CVE-2018-1047_11-0-0-Final

View Code ZIP pw:eip

This repository contains a proof-of-concept exploit for CVE-2018-1047, a vulnerability in WildFly Application Server. The exploit targets a deserialization flaw in the appclient module, allowing remote code execution.

Classification

Working Poc 90%

Attack Type

Deserialization

Complexity

Moderate

Reliability

Reliable

Target: WildFly Application Server 11.0.0.Final

No auth needed

Prerequisites: Network access to the target WildFly server · Vulnerable version of WildFly (11.0.0.Final)

MITRE ATT&CK