The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a vigilance database and tools to fix them.

Vulnerability of JBoss AS: Cross Site Request Forgery of JMX Console

Synthesis of the vulnerability 

When the administrator is logged on the JMX Console of JBoss AS, an attacker can invite him to display a malicious web page, in order to automatically deploy a WAR file via the DeploymentFileRepository MBean.
Impacted products: JBoss AS OpenSource, JBoss EAP by Red Hat.
Severity of this bulletin: 2/4.
Creation date: 16/06/2010.
Références of this threat: VIGILANCE-VUL-9711.

Description of the vulnerability 

The JMX Console of JBoss Application Server is used to administer the site.

The DeploymentFileRepository MBean is used to easily deploy a WAR application on the site.

The page http://server:8080/jmxconsole/HtmlAdaptor can directly call DeploymentFileRepository, without confirmation, in order to deploy a malicious application.

When the administrator is logged on the JMX Console of JBoss AS, an attacker can therefore invite him to display a malicious web page containing an image to HtmlAdaptor, in order to automatically deploy a WAR file via the DeploymentFileRepository MBean.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This computer vulnerability note impacts software or systems such as JBoss AS OpenSource, JBoss EAP by Red Hat.

Our Vigil@nce team determined that the severity of this computer vulnerability announce is medium.

The trust level is of type confirmed by the editor, with an origin of document.

A proof of concept or an attack tool is available, so your teams have to process this alert. An attacker with a technician ability can exploit this cybersecurity announce.

Solutions for this threat 

JBoss AS: workaround for JMX Console.
A workaround is to logout from JMX Console, and to not visit other websites during its usage.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service 

Vigil@nce provides software vulnerability bulletins. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.