HTTP: Red Hat JBoss Application Server doFilter Insecure Deserialization
An insecure deserialization vulnerability has been reported in Red Hat JBoss Application Server.A remote, unauthenticated attacker can exploit this vulnerability by sending a maliciously crafted serialized object.Successful exploitation can result in arbitrary code execution in the security context of the SYSTEM/root user.
Extended Description
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
Affected Products
Redhat jboss_enterprise_application_platform
Short Name
HTTP:MISC:RED-HAT-JBOSS-CE
Severity
Critical
Recommended
True
Recommended Action
Drop
Category
HTTP
Keywords
Application CVE-2017-12149 Deserialization Hat Insecure JBoss Red Server bid:100591 doFilter
Release Date
12/12/2017
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3337
False Positive
Unknown
Vendors
Redhat
CVSS Score
7.5