Arbitrary File Read Exploit Hotfix

This hot fix removes an arbitrary file read exploit that allows an attacker to read the content of any file on the server hosting the DAS. This exploit attacks the administration console with a specific string, bypassing secure administration and any required login details. Therefore, if the administration console is not publicly accessible, and Payara Server is running under a restricted user (as per best practice), then the risk is minimised.

Download Payara Server 161,  including the fix. 

################### WARNING ####################

For the hotfix to take effect, you will need to stop and start your DAS.

It is not necessary to restart your other instances, though specific setups may find it beneficial to do so.

################################################

This fix applies to all versions of Payara Server prior to version 4.1.1.161.

To apply the hotfix:

• Shut down the DAS: asadmin stop-domain $DOMAIN_NAME
• Create a backup of your Payara server install and configuration
• Delete the following file: $PAYARA_HOME/glassfish/lib/install/applications/__admingui/WEB-INF/extra/webui-jsf-4.0.2.10.jar
• Download the following artefact: https://s3-eu-west-1.amazonaws.com/payara-patches/com/sun/woodstock/webui-jsf/4.0.2.10.payara-p2/webui-jsf-4.0.2.10.payara-p2.jar
• Copy the downloaded artefact (webui-jsf-4.0.2.10.payara-p2.jar) into the same directory as the deleted file: $PAYARA_HOME/glassfish/lib/install/applications/__admingui/WEB-INF/extra/
• Rename the new jar file (webui-jsf-4.0.2.10.payara-p2.jar) to webui-jsf-4.0.2.10.jar (to match the deleted original).

Restart your DAS: asadmin start-domain $DOMAIN_NAME