CVEs-PoC/2019/CVE-2019-10182.md

CVE-2019-10182

Description

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.

POC

Reference

• http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html
• https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344
• https://seclists.org/bugtraq/2019/Oct/5

Github

• https://github.com/irsl/icedtea-web-vulnerabilities