CVE-2025-23367: Org.wildfly.core:wildfly-server: wildfly improper rbac permission
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qr6x-62gq-4ccp. This link is maintained to preserve external references.
Original Description A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
Other sources
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
Impact Standalone server (Domain mode is not affected) with use access control enabled with RBAC provider can be suspended or resumed by unauthorized users. When a server is suspended, the server will stop receiving user requests. The resume handle does the opposite; it will cause a suspended server to start accepting user requests.
Patches Fixed in WildFly Core 27.0.1.Final
Workarounds No workaround available
References See also: https://issues.redhat.com/browse/WFCORE-7153
Acknowledgements The WildFly project would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue. https://www.gruppotim.it/it/footer/red-team.html
— GitHub
When the authorization to control management operations is secured using the Role Based Access Control provider a user without the required privileges can suspend or resume the server.
A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server.
The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
When a server is suspended, the server will stop receiving user requests. The resume handle does the opposite; it will cause a suspended server to start accepting user requests.
Standalone server (Domain mode is not affected). RBAC access control must be enabled with RBAC provider. There is a user with a Monitor or Auditor role.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.wildfly.core:wildfly-serverto a version that resolves this vulnerability.Fixed in 28.0.0.Beta2 - Upgrade
Upgrade
maven/org.wildfly.core:wildfly-serverto a version that resolves this vulnerability.Fixed in 27.0.1.Final - Upgrade
Upgrade
org.wildfly.core:wildfly-serverto a version that resolves this vulnerability.Fixed in 27.0.1.Final - Configuration
Ensure RBAC access control is enabled and configured to use the RBAC provider for management operations so authorization checks apply to Suspend/Resume handlers.
WildFly RBAC provider (access control) RBAC access control must be enabled with RBAC provider = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23367?
The severity of CVE-2025-23367 is classified as moderate.
How do I fix CVE-2025-23367?
To fix CVE-2025-23367, upgrade Wildfly Server to version 28.0.0.Beta2 or 27.0.1.Final.
What impact does CVE-2025-23367 have on Wildfly Server?
CVE-2025-23367 may lead to unauthorized access due to flaws in the Role Based Access Control (RBAC) provider.
Which versions of Wildfly Server are affected by CVE-2025-23367?
CVE-2025-23367 affects Wildfly Server versions prior to 27.0.1.Final and 28.0.0.Beta2.
Is CVE-2025-23367 a duplicate vulnerability?
Yes, CVE-2025-23367 has been withdrawn as it is a duplicate of GHSA-qr6x-62gq-4ccp.