MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server

A reflected Cross Site Scripting (XSS) attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can run arbitrary JavaScript code, impersonating the user and leverage admin functionalities for malicious purposes.

Because the XSS is in the Payara Admin Console, an attacker can use this to perform arbitrary requests that leverage admin features (e.g. H2 Connection Strings, Web Application Deployment, etc.) in order to obtain Remote Code Execution (RCE).

Why no CVE?

Could not be bothered to request a CVE for a Reflected XSS from 2022, but, as I am rather fond of the async "fetch" based JS script leading to RCE and the " target="_blank" " HTML trick, I have decided to post this writeup. Hope you find it useful/entertaining.

Requirements:

This vulnerability requires:

• Convincing a legitimate Payara Server admin user to access the malicious URL and click the "Choose File" button

Proof Of Concept:

More details and the exploitation process can be found in this PDF.

Timeline: