CVE-2017-12149

2017-10-0400:00:00

attackerkb.com

152

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.972 High

EPSS

Percentile

99.7%

JSON

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Recent assessments:

theguly at February 28, 2020 4:30pm UTC reported:

jboss is widely used in enterprise, and we sometimes found it internet exposed.
there are ready to use exploit and scanner ( <https://github.com/joaomatosf/jexboss> ) that let an attacker to blindly abuse this.

(un)fortunately, jboss by default runs as limited user, therefore LPE is needed to get root.

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 5