REDHAT-BUG-574105: Jboss vulnerability
By using a specially crafted HTTP request, the authentication of the jmx-console can be bypassed, as the access restrictions only apply for GET and POST.
Current setting is:
<security-constraint> <web-resource-collection> <web-resource-name>HtmlAdaptor</web-resource-name> <description>An example security config that only allows users with the role JBossAdmin to access the HTML JMX console web application </description> <url-pattern>/</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>JBossAdmin</role-name> </auth-constraint> </security-constraint>
and should be changed to block ALL http-methods.
Acknowledgements:
Red Hat would like to thank Stefano Di Paola and Giorgio Fedon of Minded Security for responsibly reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-574105?
The severity of REDHAT-BUG-574105 is considered high due to the potential bypassing of authentication.
How do I fix REDHAT-BUG-574105?
To fix REDHAT-BUG-574105, ensure that all HTTP methods are properly restricted in the security configuration.
Which version of JBoss is affected by REDHAT-BUG-574105?
REDHAT-BUG-574105 affects various versions of JBoss Application Server.
Can unauthorized access occur due to REDHAT-BUG-574105?
Yes, unauthorized access can occur because the restrictions do not apply to all HTTP methods.
What is the impact of exploiting REDHAT-BUG-574105?
Exploiting REDHAT-BUG-574105 could allow attackers to access sensitive JMX console features without proper authentication.