REDHAT-BUG-2431939: Medium severity WildFly WildFly vulnerability
A remote user authenticated as ‘deployer’ account can import and deploy a malicious archive file from an untrusted source outside the intended control environment. In this specific case, the attacker leveraged WildFly (open source) libraries to craft a Java project that enabled them to perform an HTTP POST request to upload and deploy the malicious archive file from the untrusted source. In this particular scenario, the archive file is a WAR that contains a “read.jsp” page. Once the attacker uploads this file, they can leverage it to exploit other vulnerabilities, such as Arbitrary File Read, as dimostrated in this case.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to carry out this activity?
The attacker must be remotely authenticated as the ‘deployer’ account. The described technique uses WildFly libraries to create a Java project that sends an HTTP POST request to upload and deploy the archive.
What could an attacker do after deploying the malicious archive?
The archive can be a WAR containing a “read.jsp” page. After upload and deployment, it may be used to exploit other issues, including arbitrary file read, as demonstrated in the reported scenario.
Does the report establish that an unauthenticated remote attacker can exploit this?
No. The provided information describes an attacker authenticated as the ‘deployer’ account and does not state that unauthenticated access is sufficient.