Red Hat JBoss - Web/JMX Console Access

Exploited in the wild. Listed by CISA on 2022-05-25; known to be used by ransomware.

highseverity

7.5CVSS score

52.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Red Hat JBoss Enterprise Application Platform (EAP) can expose the Web Console, JMX Console, and JMXInvokerServlet without authentication, allowing remote attackers to reach admin dashboards and interact with MBeans, leading to full server compromise.

Impact

Attackers can retrieve sensitive information by bypassing access controls, leading to information disclosure.

Fix

Restrict access to /web-console, /jmx-console and /invoker, and enforce authentication on the JBoss management interfaces.

How to confirm it

Send: GET {{BaseURL}}/jmx-console/
Positive when: status 200 AND contains "JMX Agent View" or "jboss.system:type" or "HtmlAdaptor?action"
Send: GET {{BaseURL}}/web-console/ ; GET {{BaseURL}}/web-console/ServerInfo.jsp
Positive when: status 200 AND contains "JBoss Management Console" or "org.jboss.console"
Send: GET {{BaseURL}}/invoker/JMXInvokerServlet
Positive when: status 200 AND contains in header "application/x-java-serialized-object"

Run it with nuclei: nuclei -id CVE-2010-1428 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2010-1428

info:
  name: Red Hat JBoss - Web/JMX Console Access
  author: Jayachandran from Securin Labs (https://securin.io)
  severity: high
  description: |
    Red Hat JBoss Enterprise Application Platform (EAP) can expose the Web Console, JMX Console, and JMXInvokerServlet without authentication, allowing remote attackers to reach admin dashboards and interact with MBeans, leading to full server compromise.
  impact: |
    Attackers can retrieve sensitive information by bypassing access controls, leading to information disclosure.
  remediation: |
    Restrict access to /web-console, /jmx-console and /invoker, and enforce authentication on the JBoss management interfaces.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2010-1428
    - https://access.redhat.com/security/cve/CVE-2010-1428
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.5
    cve-id: CVE-2010-1428
    epss-score: 0.52654
    epss-percentile: 0.98978
    cwe-id: CWE-306
  metadata:
    verified: false
    max-request: 3
    vendor: redhat
    product: jboss_enterprise_application_platform
    shodan-query:
      - http.html:"/jmx-console/"
      - http.title:"jboss"
      - cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
    fofa-query: 'title="JBoss" && body="/jmx-console/"'
  tags: cve,cve2010,jboss,redhat,unauth,exposure,auth-bypass,kev,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/jmx-console/"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "JMX Agent View"
          - "jboss.system:type"
          - "HtmlAdaptor?action"
        condition: or

  - method: GET
    path:
      - "{{BaseURL}}/web-console/"
      - "{{BaseURL}}/web-console/ServerInfo.jsp"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "JBoss Management Console"
          - "org.jboss.console"
        condition: or

  - method: GET
    path:
      - "{{BaseURL}}/invoker/JMXInvokerServlet"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "application/x-java-serialized-object"

References

Use this check only on systems you are authorised to test. Where the data comes from