CVE-2017-7504 Scanner

JBoss Application Server is a Java-based application server commonly used by organizations to deploy and manage enterprise Java applications and services. It provides infrastructure components for web applications, messaging, transactions, and other enterprise workloads. JBossMQ is the messaging subsystem included with older JBoss Application Server releases and provides Java Message Service (JMS) functionality for asynchronous communication between applications. The JBossMQ HTTP Invocation Layer enables JMS communication to be transported over HTTP, allowing messaging operations to pass through environments where direct messaging protocols may not be available. This functionality was commonly used in legacy enterprise deployments that relied on JBoss Application Server for application integration and messaging services. JBoss Application Server 4.x and earlier releases containing the affected JBossMQ HTTP Invocation Layer may therefore expose the vulnerable functionality when the corresponding service is deployed.

CVE-2017-7504 is an unauthenticated Java deserialization vulnerability affecting the JBossMQ HTTP Invocation Layer in JBoss Application Server 4.x and earlier versions. The vulnerability occurs because the HTTP invocation service accepts serialized Java objects from an untrusted HTTP request body without sufficiently restricting the classes that can be deserialized. An unauthenticated remote attacker can therefore submit attacker-controlled serialized objects to the affected service. If a suitable malicious object chain is available in the application classpath, unsafe deserialization may result in arbitrary code execution within the context of the JBoss server process. Crafted serialized objects may also cause application crashes or other denial-of-service conditions depending on the payload and runtime environment. Because exploitation requires no authentication and can potentially compromise the confidentiality, integrity, and availability of the affected server, the vulnerability is considered critical.

The vulnerable functionality is exposed through the JBossMQ HTTP Invocation Layer endpoint at /jbossmq-httpil/HTTPServerILServlet. The servlet accepts HTTP POST requests containing Java serialized data with the application/octet-stream content type and attempts to deserialize the supplied object before processing it as an org.jboss.mq.il.http.HTTPILRequest. The scanner submits a benign serialized Java string to this endpoint rather than a code-execution payload. When the endpoint deserializes the supplied object and subsequently attempts to cast it to the expected HTTPILRequest type, the response can contain both java.lang.ClassCastException and cannot be cast to org.jboss.mq.il.http.HTTPILRequest. Receiving these characteristic error messages together with an HTTP 200 response demonstrates that attacker-controlled serialized data reaches the vulnerable deserialization process. This behavior confirms exposure of the affected JBossMQ HTTP invocation functionality without requiring execution of a destructive or malicious serialized object.

Successful exploitation of CVE-2017-7504 may allow a remote unauthenticated attacker to execute arbitrary code with the privileges of the JBoss Application Server process. An attacker who achieves code execution could access or modify application data, deploy malicious components, retrieve sensitive configuration information, or use the compromised server as a foothold for further attacks within the environment. Depending on the privileges and network position of the affected server, compromise may extend to connected databases, internal services, credentials, or other enterprise resources accessible from the JBoss host. Malicious serialized objects may also trigger application instability or denial-of-service conditions, disrupting applications hosted by the affected server. Compromise of a centrally deployed application server can significantly affect the confidentiality, integrity, and availability of dependent business services. Organizations should migrate affected JBoss AS installations to a supported Red Hat JBoss EAP release or remove the jbossmq-httpil.sar deployment when JMS over HTTP functionality is not required.

REFERENCES

• https://github.com/vulhub/vulhub/blob/master/jboss/CVE-2017-7504/README.md
• https://nvd.nist.gov/vuln/detail/CVE-2017-7504