joe-deadjoe-file-exposure: Joe Editor DEADJOE File - Exposure

2026-01-16 Joe Editor PoC Public

Description

Detected Deadjoe file,this file was created by Joe's Own Editor when a session terminated abnormally. It contained the full contents of the file being edited at the time of the crash, potentially exposing sensitive information such as passwords, configuration files, or credentials.

PoC

id: joe-deadjoe-file-exposure

info:
  name: Joe Editor DEADJOE File - Exposure
  author: 0x_Akoko
  severity: low
  description: |
    Detected Deadjoe file,this file was created by Joe's Own Editor when a session terminated abnormally. It contained the full contents of the file being edited at the time of the crash, potentially exposing sensitive information such as passwords, configuration files, or credentials.
  reference:
    - https://www.acunetix.com/vulnerabilities/web/joe-editor-deadjoe-file/
    - https://www.invicti.com/web-application-vulnerabilities/joe-editor-deadjoe-file
    - https://www.freebsd.org/security/advisories/FreeBSD-SA-01:04.joe.asc
  classification:
    cwe-id: CWE-538
  metadata:
    verified: true
    max-request: 1
  tags: exposure,deadjoe,misconfig,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/DEADJOE"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "JOE was aborted", "modified files were found in JOE", "JOE when it aborted")'
          - 'contains_all(body, "***", "JOE")'
        condition: and
# digest: 490a0046304402201874d876868a6a1f8b8cd37e8bc8da2f92371fe40d2f264bbceccc05aa4243e702205db61208fc8bb4e717b83a3ed1c87dfaf86c0f45aaf7692a01e9b754c9535976:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/files/joe-deadjoe-file-exposure.yaml

References

Related Vulnerabilities