Unauthenticated LFI (Local File Inclusion) using the symbol `!`

Program: U.S. Dept Of Defense Bug Type: path traversal Bounty: Unspecified Date: 2024-10-12
path-traversal violation-of-secure-design-principal

Summary

The researcher found that the Jolokia endpoint /jolokia/exec/com.sun.management:type=DiagnosticCommand/compilerDirectivesAdd/ is vulnerable to path traversal using ! in directory names. This allows an unauthenticated attacker to read arbitrary local files on the server, including sensitive system files like /etc/passwd and /etc/crontab, potentially exposing configuration and application secrets.

References