9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.972 High
EPSS
Percentile
99.8%
Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data.
id: CVE-2017-12149
info:
name: Jboss Application Server - Remote Code Execution
author: fopina,s0obi
severity: critical
description: Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized remote code execution on the affected server.
remediation: |
Apply the latest security patches and updates provided by Jboss to fix this vulnerability.
reference:
- https://chowdera.com/2020/12/20201229190934023w.html
- https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149
- https://nvd.nist.gov/vuln/detail/CVE-2017-12149
- https://bugzilla.redhat.com/show_bug.cgi?id=1486220
- https://access.redhat.com/errata/RHSA-2018:1607
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2017-12149
cwe-id: CWE-502
epss-score: 0.9719
epss-percentile: 0.9982
cpe: cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*
metadata:
max-request: 3
vendor: redhat
product: jboss_enterprise_application_platform
shodan-query:
- http.title:"jboss"
- cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
fofa-query: title="jboss"
google-query: intitle:"jboss"
tags: cve2017,cve,java,rce,deserialization,kev,vulhub,jboss,intrusive,redhat
http:
- raw:
- |
POST /invoker/JMXInvokerServlet/ HTTP/1.1
Host: {{Hostname}}
Content-Type: application/octet-stream
{{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
- |
POST /invoker/EJBInvokerServlet/ HTTP/1.1
Host: {{Hostname}}
Content-Type: application/octet-stream
{{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
- |
POST /invoker/readonly HTTP/1.1
Host: {{Hostname}}
Content-Type: application/octet-stream
{{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
matchers-condition: and
matchers:
- type: word
part: body
words:
- ClassCastException
- type: status
status:
- 200
- 500
# digest: 4b0a0048304602210093a029dbe058a25a05e53abbb431152e07db1e0304aa1feb9af3f783577e3e62022100de2b630f57bdf4e444177d9fcd3937b26db57bf1f115f7814a0c67a3e7b7cd85:922c64590222798bb761d5b6d8e72950
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.972 High
EPSS
Percentile
99.8%