Jboss Application Server - Remote Code Execution

Exploited in the wild. Listed by CISA on 2021-12-10; known to be used by ransomware.

criticalseverity

9.8CVSS score

90.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data.

Impact

Successful exploitation of this vulnerability can lead to unauthorized remote code execution on the affected server.

Fix

Apply the latest security patches and updates provided by Jboss to fix this vulnerability.

How to confirm it

Send: POST /invoker/JMXInvokerServlet/ ; POST /invoker/EJBInvokerServlet/ ; POST /invoker/readonly
Positive when: contains in response "JBoss" and "ClassCastException" AND status 200 or 500

Run it with nuclei: nuclei -id CVE-2017-12149 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-12149

info:
  name: Jboss Application Server - Remote Code Execution
  author: fopina,s0obi
  severity: critical
  description: Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because  the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized remote code execution on the affected server.
  remediation: |
    Apply the latest security patches and updates provided by Jboss to fix this vulnerability.
  reference:
    - https://chowdera.com/2020/12/20201229190934023w.html
    - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149
    - https://nvd.nist.gov/vuln/detail/CVE-2017-12149
    - https://bugzilla.redhat.com/show_bug.cgi?id=1486220
    - https://access.redhat.com/errata/RHSA-2018:1607
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-12149
    cwe-id: CWE-502
    epss-score: 0.90713
    epss-percentile: 0.99806
    cpe: cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: redhat
    product: jboss_enterprise_application_platform
    shodan-query:
      - http.title:"jboss"
      - cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
    fofa-query: title="jboss"
    google-query: intitle:"jboss"
  tags: cve2017,cve,java,rce,deserialization,kev,vulhub,jboss,intrusive,redhat,vkev,vuln

http:
  - raw:
      - |
        POST /invoker/JMXInvokerServlet/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/octet-stream

        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
      - |
        POST /invoker/EJBInvokerServlet/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/octet-stream

        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
      - |
        POST /invoker/readonly HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/octet-stream

        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}

    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - JBoss
          - ClassCastException
        condition: and
        case-insensitive: true

      - type: status
        status:
          - 200
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from