CVE-2019-14838: Medium severity redhat WildFly Core vulnerability

It was found that Wildfly users had default user permissions set incorrectly. A malicious user could use this flaw to access unauthorized controls for the application server.

Tested in JBoss EAP 7.2.3 GA :

The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server as mentioned in Table 2.1 and 2.2 in our product documentation :

https://access.redhat.com/documentation/en-us/redhatjbossenterpriseapplicationplatform/7.2/html-single/securityarchitecture/index#rbac

But it has been observed that these users can perform this operation. They can stop any server running in domain mode :

-------------------------------------- [domain@localhost:9990 /] /host=master/server-config=server-one:stop() { "outcome" => "success", "result" => "STOPPING" }

[domain@localhost:9990 /] /host=master/server-config=server-one:start() { "outcome" => "failed", "failure-description" => "WFLYCTL0313: Unauthorized to execute operation 'start' for resource '[ (\"host\" => \"master\"), (\"server-config\" => \"server-one\") ]' -- \"WFLYCTL0332: Permission denied\"", "rolled-back" => true } -------------------------------------

There users are allowed "stop" the server but they cannot "start" it. Ideally they should not be able to stop or start any server.

— Red Hat