CVE-2012-4529: Medium severity red hat jboss community application server vulnerability
The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.
Other sources
When the session tracking method is set to 'COOKIE' only, the org.apache.catalina.connector.Response.encodeURL() method will still return the url with the jsessionid appended as a query string parameter when processing the first request of a session. This is unexpected when sessions are only tracked using cookies. As a result, the jsessionid could be leaked in a way not anticipated by the application developer. An attacker could potentially exploit this using a man-in-the-middle attack, or extracting the jsessionid from log files.
A fix has been committed upstream on the 7.2.x branch as a commit for JBWEB-249 [1] and is committed as revision 2106 [2].
A possible mitigation for this would be to use SSL encryption as this would reduce the risk of a man-in-the-middle attack.
There are two possible workarounds that may be used. Both work by re-writing the url. The first is to use filters as described at [3]. The other option is to use rewrite valves, similar to the method outlined at [4]. Note that there is a change in rewrite syntax for JBoss Web 7.x as detailed at [5].
[1] https://issues.jboss.org/browse/JBWEB-249 [2] https://source.jboss.org/browse/JBossWeb/branches/7.2.x/src/main/java/org/apache/catalina/connector/Response.java?r2=2106&r1=2086 [3] https://access.redhat.com/knowledge/solutions/16169 [4] https://access.redhat.com/knowledge/solutions/64778 [5] http://docs.jboss.org/jbossweb/7.0.x/rewrite.html
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4529?
CVE-2012-4529 has a medium severity rating, indicating potential risk for session hijacking.
How do I fix CVE-2012-4529?
To mitigate CVE-2012-4529, upgrade your Red Hat JBoss Web server to a version later than 7.1.1.
What versions are affected by CVE-2012-4529?
CVE-2012-4529 affects Red Hat JBoss Web versions 5.0.0 to 7.1.x, including specific minor versions.
What is the impact of CVE-2012-4529?
The impact of CVE-2012-4529 allows attackers to potentially hijack user sessions through man-in-the-middle attacks.
Is CVE-2012-4529 exploitable remotely?
Yes, CVE-2012-4529 is exploitable remotely, making it critical for users of the affected software to address this vulnerability.