Red Hat JBoss Operations Network Java Object Deserialization RCE
Critical Nessus Plugin ID 91487
SynopsisThe remote JBoss Operations Network server is affected by a remote code execution vulnerability
DescriptionThe remote Red Hat JBoss Operations Network server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Jython library. An unauthenticated, remote attacker can exploit this, by sending specially crafted Java objects to the HTTP interface, to execute arbitrary code on the target host.
SolutionRed Hat has released JBoss Operations Network 3.3 Update 06 to address this issue; however, Tenable Research has confirmed that the update did not resolve the issue. To mitigate this issue, users should enable agent authentication.