CVE-2010-0738

Summary

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

Severity
Medium
Severity Score

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-ID

CWE-264

Vulnerability ID
CVE-2010-0738
Severity
Medium
Severity Score
5.0
Summary
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
References
https://rhn.redhat.com/errata/RHSA-2010-0379.html https://bugzilla.redhat.com/show_bug.cgi?id=574105 https://rhn.redhat.com/errata/RHSA-2010-0376.html http://www.vupen.com/english/advisories/2010/0992 https://rhn.redhat.com/errata/RHSA-2010-0377.html http://securitytracker.com/id?1023918 http://www.securityfocus.com/bid/39710 http://secunia.com/advisories/39563 https://rhn.redhat.com/errata/RHSA-2010-0378.html http://securityreason.com/securityalert/8408 http://marc.info/?l=bugtraq&m=132129312609324&w=2 http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35 https://exchange.xforce.ibmcloud.com/vulnerabilities/58147
Mitigation and Patches
Exploits
https://www.exploit-db.com/exploits/16319 https://www.exploit-db.com/exploits/17924 https://www.exploit-db.com/exploits/16316 https://www.exploit-db.com/exploits/16274 https://github.com/ChristianPapathanasiou/jboss-autopwn https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_bshdeployer.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/jboss_vulnscan.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/sap/sap_icm_urlscan.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_bshdeployer.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_deploymentfilerepository.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_maindeployer.rb https://github.com/ChristianPapathanasiou/jboss-autopwn https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://threatpost.com/3-2-million-servers-vulnerable-to-jboss-attack/117465/
Metasploit Payload
https://www.redteam-pentesting.de/en/publications/jboss/-bridging-the-gap-between-the-enterprise-and-you-or-whos-the-jboss-now https://bugzilla.redhat.com/show_bug.cgi?id=574105 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_bshdeployer.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/jboss_vulnscan.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/sap/sap_icm_urlscan.rb http://www.redteam-pentesting.de/publications/jboss https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_bshdeployer.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_deploymentfilerepository.rb https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_maindeployer.rb
Vector
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE ID
CWE-264

See SecOps Solution
in action

Schedule Demo