Oracle GlassFish Server Administration Console Remote Authentication Bypass Vulnerability

Bugtraq ID:	47818
Class:	Access Validation Error
CVE:	CVE-2011-1511
Remote:	Yes
Local:	No
Published:	May 12 2011 12:00AM
Updated:	Jan 05 2012 05:50PM
Credit:	Corelabs and David Spencer of NGS Secure Research.
Vulnerable:	Sun Glassfish Enterprise Server 2.1.1 Oracle Glassfish Server 3.0.1
Not Vulnerable:	Oracle Glassfish Server 3.1

Oracle GlassFish Server Administration Console Remote Authentication Bypass Vulnerability

The Oracle GlassFish Server Administration Console is prone to a remote authentication-bypass vulnerability.

Attackers can exploit this issue to bypass authentication and perform unauthorized actions like obtaining sensitive information and creating an administrator account. Attackers can use the newly created administrator account to execute arbitrary code in the context of server which runs as root by default.

The following products are affected:

Oracle GlassFish Server 3.0.1
Sun GlassFish Enterprise Server 2.1.1

Oracle GlassFish Server Administration Console Remote Authentication Bypass Vulnerability

Example requests to create an administrator account is available; please see references.

The following exploit is available:

• /data/vulnerabilities/exploits/47818.py

Oracle GlassFish Server Administration Console Remote Authentication Bypass Vulnerability

Solution:
A vendor patch is available. Please see the references for more information.

Oracle GlassFish Server Administration Console Remote Authentication Bypass Vulnerability

References:

• Oracle GlassFish Server (Oracle)
  
• Oracle GlassFish Server Administration Console Authentication Bypass (CORE)
  
• NGS00106 Technical Advisory: Increased exploitation of Oracle GlassFish Server A (NGS Secure)
  
• Oracle Critical Patch Update Advisory - July 2011 (Oracle)