CVE-2017-20284: Caucho Resin Path Traversal Vulnerability

CVE-2017-20284 Overview

Caucho Resin contains a path traversal vulnerability [CWE-22] in the resin-doc documentation webapp. Remote unauthenticated attackers can read arbitrary files on the underlying host by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. The vulnerable endpoint processes user-controlled path input without normalizing directory traversal sequences. The Shadowserver Foundation first observed exploitation evidence on 2021-12-10, indicating active abuse against exposed instances.

Critical Impact
Unauthenticated remote attackers can exfiltrate configuration files, credentials, and other sensitive data readable by the Resin service account.

Affected Products

Caucho Resin application server with the resin-doc webapp deployed
Instances exposing the jndi-appconfig tutorial servlet
Any Resin deployment retaining default documentation and tutorial content

Discovery Timeline

2021-12-10 - Exploitation evidence first observed by the Shadowserver Foundation
2026-09-18 - CVE CVE-2017-20284 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2017-20284

Vulnerability Analysis

The vulnerability resides in the jndi-appconfig tutorial servlet shipped inside the resin-doc webapp. The servlet accepts a caller-supplied inputFile parameter intended to reference local tutorial resources. The handler resolves this parameter against the filesystem without validating that the resulting path stays within the tutorial directory. As a result, an attacker can supply relative path traversal sequences such as ../../../../etc/passwd and receive the file contents in the HTTP response. The issue is exploitable over the network with no authentication and no user interaction, giving attackers a low-cost reconnaissance primitive against exposed Resin servers. Files disclosed commonly include Resin configuration such as resin.xml, deployed application descriptors, and credentials stored on disk.

Root Cause

The root cause is missing input sanitization on the inputFile request parameter. The tutorial code trusts caller-supplied path fragments and concatenates them into a filesystem lookup without canonicalizing the result or enforcing a base-directory allowlist. This design pattern is the classic path traversal weakness described by [CWE-22].

Attack Vector

Exploitation requires only network access to the Resin HTTP listener where resin-doc is deployed. An attacker issues an HTTP GET request to the jndi-appconfig tutorial endpoint and sets the inputFile parameter to a relative path containing ../ sequences that escape the tutorial directory. The server returns the referenced file contents in the response body. No credentials, cookies, or CSRF tokens are required. See the VulnCheck Advisory on Caucho Resin and the Blackstone Analysis on Resin Attacks for endpoint-level technical detail.

Detection Methods for CVE-2017-20284

Indicators of Compromise

HTTP requests to resin-doc tutorial paths containing jndi-appconfig combined with an inputFile query parameter
Request payloads containing traversal sequences such as ../, ..%2f, or encoded variants targeting inputFile
Anomalous read access to sensitive files (resin.xml, /etc/passwd, application deployment descriptors) by the Resin JVM process
Outbound scanning patterns from source IPs known to Shadowserver as scanners for Resin path traversal

Detection Strategies

Deploy web application firewall (WAF) rules that block inputFile parameters containing traversal sequences or absolute paths
Alert on any HTTP 200 response from resin-doc endpoints where the request path includes jndi-appconfig
Correlate Resin access logs against process-level file read telemetry to identify files read outside the webapp root

Monitoring Recommendations

Enable verbose access logging on the Resin HTTP connector and forward logs to a centralized SIEM for query and retention
Baseline normal resin-doc request volume and alert on spikes that indicate scanning activity
Monitor egress from Resin hosts for unexpected data volumes that follow suspicious resin-doc requests

How to Mitigate CVE-2017-20284

Immediate Actions Required

Remove or disable the resin-doc webapp from all production Resin deployments
Restrict network access to Resin management and documentation endpoints using firewall rules or reverse-proxy allowlists
Audit Resin hosts for evidence of unauthorized file reads targeting resin.xml and other credential-bearing files
Rotate any credentials, keys, or secrets stored on disk in files reachable by the Resin process

Patch Information

Caucho Resin is an end-of-life product and no vendor patch has been published for this issue. Refer to the VulnCheck Advisory on Caucho Resin and the Caucho Resin Product Information page for vendor status. Organizations should plan migration away from unsupported Resin builds.

Workarounds

Undeploy the resin-doc webapp by removing its WAR/directory from the Resin webapps folder and restarting the server
Block external requests to any URI path containing resin-doc at the load balancer or reverse proxy
Add WAF signatures that reject requests containing inputFile= combined with ../ or URL-encoded traversal sequences
Run the Resin process under a low-privilege account with filesystem ACLs that deny read access to configuration and credential files outside the webapp root

bash

# Configuration example: remove resin-doc and block traversal at the proxy
rm -rf $RESIN_HOME/webapps/resin-doc
rm -rf $RESIN_HOME/doc

# Example nginx rule to drop traversal attempts against resin-doc
# location ~* /resin-doc/ { return 403; }
# if ($args ~* "inputFile=.*\.\./") { return 403; }