CVE-2022-2712

What it actually does

The flaw permits remote unauthenticated requests containing paths that begin with './' to bypass directory restrictions, allowing direct read access to arbitrary files including server configuration and deployed application source code.

Why it matters to the business

Attackers can obtain configuration secrets and application source code, increasing the risk of targeted follow-on attacks, data exposure, or intellectual property theft with minimal attacker effort.

How an attack unfolds

An unauthenticated attacker issues HTTP requests to the server using relative paths prefixed with './' to traverse outside intended directories and retrieve sensitive files such as domain.xml or application WAR contents.

How to fix it

Upgrade Eclipse GlassFish to a release that enforces proper filtering of paths beginning with './'; until a fixed version is available, restrict web access to sensitive directories via web server rules or application firewall policies.

How to confirm the fix worked

Attempt to retrieve known configuration files using requests prefixed with './' from an external host and confirm that the server returns an error or empty response instead of file contents.

Typical attack path

1. Craft HTTP GET request containing a path starting with './'
2. Target endpoints that serve static or configuration resources
3. Exfiltrate configuration files and application source code
4. Use obtained information to identify additional weaknesses

How to detect it

Inspect web server access logs for HTTP requests whose URI begins with or contains './' followed by traversal sequences; correlate with file read events on configuration or application directories.

• HTTP request line containing './'
• Access attempts to paths ending in domain.xml or similar configuration files via relative traversal

What your security team should do

• Block or log all inbound requests containing './' path segments at the perimeter
• Review and restrict file permissions on configuration and source directories
• Monitor vendor advisories for an official fixed release and apply it promptly
• Scan deployed applications for embedded sensitive data that could be exposed