JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization

criticalseverity

9.8CVSS score

38.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The JMS over HTTP Invocation Layer in JBossMQ, as implemented in HTTPServerILServlet.java in JBoss Application Server (AS) 4.x and earlier, does not properly restrict the classes that can be deserialized from the raw POST body. This allows remote attackers to execute arbitrary code or cause a denial of service (application crash or other impacts) via crafted serialized objects, due to insecure Java object deserialization.

Impact

Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.

Fix

Upgrade JBoss AS to a supported EAP version, or remove the jbossmq-httpil.sar deployment if JMS-over-HTTP is not required.

How to confirm it

Send: POST {{BaseURL}}/jbossmq-httpil/HTTPServerILServlet
Positive when: contains "cannot be cast to org.jboss.mq.il.http.HTTPILRequest" and "java.lang.ClassCastException" AND status 200

Run it with nuclei: nuclei -id CVE-2017-7504 -u <target>

The full check

id: CVE-2017-7504

info:
  name: JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization
  author: Securin
  severity: critical
  description: |
    The JMS over HTTP Invocation Layer in JBossMQ, as implemented in HTTPServerILServlet.java in JBoss Application Server (AS) 4.x and earlier, does not properly restrict the classes that can be deserialized from the raw POST body. This allows remote attackers to execute arbitrary code or cause a denial of service (application crash or other impacts) via crafted serialized objects, due to insecure Java object deserialization.
  impact: |
    Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.
  remediation: |
    Upgrade JBoss AS to a supported EAP version, or remove the jbossmq-httpil.sar deployment if JMS-over-HTTP is not required.
  reference:
    - https://github.com/vulhub/vulhub/blob/master/jboss/CVE-2017-7504/README.md
    - https://nvd.nist.gov/vuln/detail/CVE-2017-7504
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-7504
    cwe-id: CWE-502
    epss-score: 0.38878
    epss-percentile: 0.98601
    cpe: cpe:2.3:a:redhat:jboss_application_server:4.0.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: redhat
    product: jboss_application_server
    shodan-query: http.title:"JBoss"
    fofa-query: app="JBoss"
  tags: cve,cve2017,redhat,jboss,jbossmq,deserialization,rce,vkev

http:
  - method: POST
    path:
      - "{{BaseURL}}/jbossmq-httpil/HTTPServerILServlet"
    headers:
      Content-Type: application/octet-stream
    body: "{{base64_decode(\"rO0ABXQABWhlbGxv\")}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "cannot be cast to org.jboss.mq.il.http.HTTPILRequest"
          - "java.lang.ClassCastException"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from