REDHAT-BUG-2478005: Medium severity Red Hat JBoss EAP vulnerability

initial report: RCE — pre-auth IIOP/GIOP CDR deserialization in EjbCorbaServant.readParams (:3528) (JBoss EAP)

Pre-auth remote code execution via IIOP: the EjbCorbaServant.readParams() method on the :3528 IIOP listener deserializes CDR-marshalled Java objects using an unfiltered ObjectInputStream before any authentication check, allowing an unauthenticated attacker to achieve OS command execution as the EAP process uid with a single GIOP request.

findings/jboss-eap18.md

----- secarx findings: This is better suited as a Moderate impact CVE (New CVE required) for JBoss EAP 7.4 and Low impact for JBoss EAP 8.

Reasons : The finding correctly identifies a real architectural weakness: deserialization of method parameters occurs before authentication in the IIOP invocation path. However, The claim that this uses "an unfiltered ObjectInputStream" is factually wrong — it uses CDR stream readers that are type-constrained to declared EJB parameter types.

The claim of guaranteed "OS command execution with a single GIOP request" overstates exploitability. Actual exploitation requires: (a) network access to port 3528 (loopback by default) (b) an EJB with an untyped method parameter exposed via IIOP (c) a suitable gadget chain on the classpath.

EAP 8.1.0 adds the further mitigation that IIOP exposure is disabled by default per-bean.