Caucho Resin Information Disclosure Scan

Caucho Resin is a high-performance, open-source Java application server used by businesses to host Java applications, platforms, and services. It is commonly deployed by enterprises that require reliable and scalable Java-based web services and applications. The software provides a full-stack Java Enterprise Edition (Java EE) server supporting advanced technologies like JavaServer Pages (JSP) and servlets. Developers and system administrators utilize Resin for its robust performance in producing dynamic, feature-rich web applications.

An information disclosure vulnerability in Caucho Resin arises when the server is misconfigured, allowing unauthorized access to sensitive data. This typically occurs due to default settings that expose directories like /resin-doc or /WEB-INF without proper access controls. Attackers can exploit this by sending crafted HTTP requests to enumerate files and directories that reveal internal application details.

The vulnerability specifically targets the /resin-doc endpoint, which may contain documentation, configuration files, and sample applications. By accessing this directory, an attacker can retrieve files such as resin.conf or web.xml, exposing database credentials, application paths, and other sensitive configurations. The scan checks for directory listing enabled on these paths, which should be restricted.

If exploited, an attacker can gain critical insights into the application's architecture, including database connection strings, encryption keys, and internal IP addresses. This information can be used to launch further attacks, such as SQL injection or remote code execution, potentially leading to full system compromise. The CVSS score of 7.5 reflects the high impact on confidentiality and the ease of exploitation.