CVE-2022-45129: 
Java vulnerability analysis and mitigation

CVE-2022-45129 affects Payara Platform before 2022-11-04, allowing attackers to access META-INF and WEB-INF directories when applications are deployed to the root context. This vulnerability impacts Payara Platform Community before versions 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, as well as Payara Platform Enterprise before 5.45.0 (Payara Blog, CVE Details).

The vulnerability is a path traversal issue that allows attackers to explore the contents of WEB-INF and META-INF folders when an application is deployed to the root context. This is similar to but distinct from CVE-2022-37422. The vulnerability occurs because the leading '../' is not detected to escape the context, and the code in StandardContextValve.java only checks the beginning of the path for forbidden directories /META-INF/ and /WEB-INF/ (SEC Consult).

When exploited, this vulnerability allows attackers to access sensitive configuration files and potentially source code stored in the WEB-INF and META-INF directories of deployed applications. This affects all distributions of the Payara Platform, including Server Full, Server Web, Micro, Embedded, and Docker images (Payara Docs).

The vulnerability can be exploited by sending an HTTP request with a path starting with '../' (without a leading slash) to an application deployed at the root context. A successful exploit allows access to files within the app's directory /app, including protected WEB-INF and META-INF folders (SEC Consult).

The vulnerability has been fixed in Payara Platform Community versions 6.2022.1, 5.2022.4, 4.1.2.191.38, and Payara Platform Enterprise version 5.45.0. Users must upgrade to these versions or later to address the security issue. There are no workarounds available; upgrading is the only solution (Payara Blog).

The vulnerability was discovered and reported by Michael Baer, Luc Créti and Jean-Michel Lenotte from Atos. The vendor acknowledged the vulnerability and worked to provide fixes across all affected versions (Payara Docs).