ID:96 - Exploit for Path traversal in Undertow - CVE-2014-7816

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows. A remote non-authenticated attacker can send a specially crafted HTTP request containing directory traversal sequences and view contents of arbitrary files on the server.

Remediation