Unauthenticated LFI (Local File Inclusion) using the symbol `!`
Program: U.S. Dept Of Defense
Bug Type: path traversal
Bounty: Unspecified
Date: 2024-10-12
path-traversal
violation-of-secure-design-principal
Summary
The researcher found that the Jolokia endpoint /jolokia/exec/com.sun.management:type=DiagnosticCommand/compilerDirectivesAdd/ is vulnerable to path traversal using ! in directory names. This allows an unauthenticated attacker to read arbitrary local files on the server, including sensitive system files like /etc/passwd and /etc/crontab, potentially exposing configuration and application secrets.