CVE-2017-20284 is a high severity (CVSS 7.5) path traversal in the resin-doc documentation webapp of Caucho Resin. An unauthenticated user can read files outside the tutorial directory through the inputFile parameter of the jndi-appconfig servlet. Remove resin-doc from any server that faces the internet.
What's affected
Caucho Resin, where the documentation webapp (resin-doc) is deployed, per the record. VulnCheck lists the affected range as Resin up to an unspecified version, so no version boundary is confirmed, and I could not find a fixed release in the sources available.
The problem is not in the core server. It is in a tutorial servlet that ships in the documentation webapp. The record says the inputFile request parameter of the jndi-appconfig servlet accepts relative paths, so files outside the tutorial directory can be read.
That framing helps you. If your servers do not deploy resin-doc, the issue does not apply to them. If they do, the quickest mitigation is to remove it.
Resin is an application server, so one install can host many applications. The documentation webapp is a separate application that ships alongside them, which is why it can go unnoticed during hardening. Review the deployed webapps list for every Resin instance, not only the ones that serve your public site, and include internal servers that your scanners can reach.
The record says exploitation evidence was first seen in December 2021, which is four years after the original public write up linked from the record.
How to check if you're exposed
Check whether resin-doc is deployed. On a typical install, look in the Resin webapps folder, and check the URL space of your running server for a documentation path:
find /opt/resin -maxdepth 3 -iname "resin-doc*"
Adjust the path to your install location. Then ask whether the documentation is reachable from outside. From an external host, request the documentation root of a server you own and see whether it responds.
Check access logs for requests to the jndi-appconfig tutorial path, and for parameters that contain relative path sequences. Any hit from an address you do not recognise is worth investigating.
You can also inspect the running configuration. Resin lists its deployed webapps in its configuration files, and the administration pages show what is loaded. Remove the documentation webapp from the configuration as well as from disk, so that a restart does not bring it back.
What to do now
- Search every Resin server for a deployed resin-doc webapp.
- Remove resin-doc from production. Documentation and tutorials do not belong on servers that serve users.
- Check for a newer Resin release from Caucho and review its notes, since no fixed version is confirmed here.
- Review access logs for the jndi-appconfig servlet and rotate any secrets stored in files the Resin process can read.
- Run Resin under a low privilege account with access only to the folders it needs.
Why it matters
The class is CWE-22 (Path Traversal). The servlet takes a file name from the request and reads the file without making sure it stays inside the tutorial folder. A relative path that climbs out of that folder reaches any file the server account can read, such as configuration files and credentials.
What makes this record worth attention is its status. The record says exploitation evidence was first observed by the Shadowserver Foundation on 10 December 2021, and VulnCheck's advisory notes that it is in the VulnCheck KEV database. The CISA KEV flag in our record is false, so the confirmation comes from those two sources, not from CISA.
Sample and documentation applications are a long standing source of this bug. They are written to teach, not to defend, and they are often deployed by default and forgotten. Remove what you do not use.
Quick check
Is the Resin core server vulnerable?
The record describes the resin-doc documentation webapp, specifically its jndi-appconfig tutorial servlet. Check whether that webapp is deployed.
Is this exploited?
The record states that Shadowserver first observed exploitation evidence on 2021-12-10, and VulnCheck lists it in its KEV database. It is not flagged in CISA KEV.
Sources
Last reviewed: 19 October 2026.
