Path Traversal Vulnerability in Caucho Resin Documentation Webapp

Caucho Resin contains a path traversal vulnerability within the resin-doc documentation web application. This flaw affects the jndi-appconfig tutorial servlet, where the inputFile request parameter is insufficiently sanitized. Remote, unauthenticated attackers can supply crafted directory traversal sequences (e.g., ../../) via this parameter to bypass intended file access restrictions. This allows for the unauthorized reading of sensitive files located outside the tutorial directory on the underlying host system. Exploitation of this vulnerability has been observed in the wild since December 10, 2021, as documented by the Shadowserver Foundation. Defenders should prioritize removing the documentation application in production environments or applying the necessary vendor patches to mitigate risk.

Impact

Successful exploitation leads to unauthorized disclosure of sensitive system files, configuration files, or credentials stored on the server. This can facilitate further attacks, such as credential theft or system compromise, depending on the files accessible to the service account running the Resin instance.

Recommendation

• Deploy the provided Sigma rule to web server access logs to detect directory traversal patterns in URI queries.
• Audit production deployments and remove the 'resin-doc' documentation web application if it is not strictly required.
• Ensure the Resin service is running with the principle of least privilege, limiting the files accessible by the process user.