Red Hat JBoss EAP – Deserialization of Untrusted Data

• Exploit Database
• 102 阅读

• 作者： Mediaservice.net Srl.
  日期： 2016-11-28
• 类别：

  • webapps
  平台：

  • java
• 来源：https://www.exploit-db.com/exploits/40842/

• Security Advisory @ Mediaservice.net Srl
  (#05, 23/11/2016) Data Security Division
   
   Title:	Red Hat JBoss EAP deserialization of untrusted data 
   Application:	JBoss EAP 5.2.X and prior versions
   Description:	The application server deserializes untrusted data via the
  JMX Invoker Servlet. This can lead to a DoS via resource
  exhaustion and potentially remote code execution.
  Author: Federico Dotta <federico.dotta@mediaservice.net>
  Maurizio Agazzini <inode@mediaservice.net>
   Vendor Status: Will not fix
   CVE Candidate: The Common Vulnerabilities and Exposures project has assigned
  the name CVE-2016-7065 to this issue. 
  References: http://lab.mediaservice.net/advisory/2016-05-jboss.txt
  http://lab.mediaservice.net/code/jboss_payload.zip
  https://bugzilla.redhat.com/show_bug.cgi?id=1382534
  
  1. Abstract.
  
  JBoss EAP's JMX Invoker Servlet is exposed by default on port 8080/TCP. The
  communication employs serialized Java objects, encapsulated in HTTP
  requests and responses.
  
  The server deserializes these objects without checking the object type. This 
  behavior can be exploited to cause a denial of service and potentially 
  execute arbitrary code.
  
  The objects that can cause the DoS are based on known disclosed payloads
  taken from:
  
  - https://gist.github.com/coekie/a27cc406fc9f3dc7a70d
  
  Currently there is no known chain that allows code execution on JBoss EAP,
  however new chains are discovered every day.
  
  2. Example Attack Session.
  
  Submit an authenticated POST request to the JMX Invoker Servlet URL (for 
  example: http://localhost:8080/invoker/JMXInvokerServlet) with one of the 
  following objects in the body of the request:
  
  * 01_BigString_limited.ser: it's a string object; the server will
  reply in a normal way (object size similar to the next one).
  * 02_SerialDOS_limited.ser: the application server will require
  about 2 minutes to execute the request with 100% CPU usage.
  * 03_BigString.ser: it's a string object; the server will
  reply in a normal way (object size similar to the next one).
  * 04_SerialDOS.ser: the application server will require an 
  unknown amount of time to execute the request with 100% CPU usage.
  
  3. Affected Platforms.
  
  This vulnerability affects versions 4 and 5 of JBoss EAP.
  
  4. Fix.
  
  Red Hat will not fix the issue because JBoss EAP 4 is out of maintenance 
  support and JBoss EAP 5 is close to the end of its maintenance period. 
  
  5. Proof Of Concept.
  
  See jboss_payload.zip (40842.zip) and Example Attack Session above.
  
  http://lab.mediaservice.net/code/jboss_payload.zip
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40842.zip
  
  6. Timeline
  
  06/10/2016 - First communication sent to Red Hat Security Response Team
  07/10/2016 - Red Hat Security Response Team response, Bug 1382534 
  23/11/2016 - Security Advisory released
  
  Copyright (c) 2016 @ Mediaservice.net Srl. All rights reserved.
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40842.zip
  

  Java

  Copy