In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1607 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This asynchronous patch is a security update for JBoss invoker in Red Hat JBoss Enterprise Application     Platform 5.2.0.

    Security Fix(es):

    * jbossas: Arbitrary code execution via unrestricted deserialization in ReadOnlyAccessFilter of HTTP     Invoker. (CVE-2017-12149)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Joao F M Figueiredo for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The JBoss Application Server installed on the remote host is affected by a remote code execution vulnerability. A flaw in the doFilter method of the ReadOnlyAccessFilter class, of the HTTP Invoker service doesn't restrict classes for which it performs deserialization.
This allows a remote, unauthenticated attacker to execute arbitrary code via crafted serialized data.

To conduct more accurate test and get precise evidence of RCE exploitation please set 'Perform thorough tests (may disrupt your network or impact scan speed)' setting in the Scan Configuration.

ID	Name	Product	Family	Type	Severity
109990	RHEL 6 : Red Hat JBoss Enterprise Application Platform 5.2 (RHSA-2018:1607)	Nessus	Red Hat Local Security Checks	Local	critical
109321	JBoss Enterprise Application Platform doFilter() Method Insecure Deserialization RCE	Nessus	Web Servers	Remote	critical

Detections

Analytics

CVE-2017-12149

critical

Tenable Plugins

critical

critical