Short Name |
HTTP:MISC:RED-HAT-JBOSS-CE |
---|---|
Severity |
Critical |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Red Hat JBoss Application Server doFilter Insecure Deserialization |
Release Date |
2017/12/11 |
Update Number |
3016 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
An insecure deserialization vulnerability has been reported in Red Hat JBoss Application Server.A remote, unauthenticated attacker can exploit this vulnerability by sending a maliciously crafted serialized object.Successful exploitation can result in arbitrary code execution in the security context of the SYSTEM/root user.
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.