CVE-2021-44138
📋 TL;DR
CVE-2021-44138 is a directory traversal vulnerability in Caucho Resin web servers that allows attackers to read arbitrary files by using semicolons in HTTP request paths. This affects Resin versions 4.0.52 through 4.0.56. Attackers can potentially access sensitive configuration files, source code, or credentials stored on the server.
💻 Affected Systems
- Caucho Resin
📦 What is this software?
Resin by Caucho
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive files like configuration files containing database credentials, private keys, or application source code, potentially leading to full system compromise.
Likely Case
Attackers can read arbitrary files accessible to the Resin process, potentially exposing sensitive application data or configuration information.
If Mitigated
With proper file system permissions and network segmentation, impact is limited to files accessible by the Resin process user.
🎯 Exploit Status
Exploitation requires only HTTP requests with crafted paths containing semicolons.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.57 and later
Vendor Advisory: https://caucho.com/products/resin/download
Restart Required: Yes
Instructions:
1. Download Resin 4.0.57 or later from the official website. 2. Stop the Resin service. 3. Replace the existing Resin installation with the patched version. 4. Restart the Resin service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement a servlet filter or web application firewall to reject HTTP requests containing semicolons in paths.
Restrict File System Access
linuxRun Resin with minimal file system permissions and use chroot/jail environments.
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with rules to block requests containing semicolons in paths.
- Restrict network access to Resin servers using firewalls and only allow trusted sources.
🔍 How to Verify
Check if Vulnerable:
Check Resin version using 'java -jar resin.jar -version' or examine server startup logs. If version is between 4.0.52 and 4.0.56 inclusive, the system is vulnerable.Check Version:
java -jar resin.jar -versionVerify Fix Applied:
After patching, verify the version is 4.0.57 or later using the same command. Test with crafted requests containing semicolons to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with semicolons in URL paths
- Access to unusual file paths in web logs
- Multiple 404 or 403 errors for crafted paths
Network Indicators:
- HTTP requests with ';' characters in paths
- Patterns of file path traversal attempts
SIEM Query:
source="resin.log" AND (url="*;*" OR status=404 AND url="*/../*")