GlassFish 4.x directory traversal (CVE-2017-1000028)

Oracle GlassFish Server 4.1 (and some 3.x) is vulnerable to a directory traversal on the theme/META-INF/* route when / is encoded with the non-canonical UTF-8 sequence %c0%af (bytes 0xC0 0xAF). Old parsers decode it to / instead of rejecting it, allowing escape from the expected directory and read of any file the service user can access.

curl 'http://<host>:4848/theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afetc/passwd'

The useful play is enumerating install directories (Synaman, MSSQL, Java) for credentials in configuration files (secrets in code) that do work against the rest of the system (RDP, SSH, other services).

Nuances. The CVE is a pure LFI: it does not yield execution. Escalation to RCE happens if the read discovers credentials that pass on an admin panel (GlassFish's own 4848 accepts WAR deploys) or another service.

How to detect it. The access-log signature is the overlong UTF-8 sequences %c0%af/%c0%ae (or %e0%80%af) in a URL toward :4848/theme/META-INF/, which no legitimate browser emits; a WAF or the parser itself rejecting %c0%* blocks and logs it. Requests ending in etc/passwd or config files via that path, and a burst of encoded ../ from one IP, confirm the traversal.

Defence. Upgrade GlassFish/Payara to recent versions or migrate. As a network mitigation, filter access to /theme/META-INF/* and reject %c0%* sequences at the URL parser before the backend sees them.