nuclei-templates/cves/2017/CVE-2017-12149.yaml

49 lines
1.8 KiB
YAML

id: CVE-2017-12149
info:
name: Jboss Application Server - Remote Code Execution
author: fopina
severity: critical
description: Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data.
reference:
- https://chowdera.com/2020/12/20201229190934023w.html
- https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149
- https://nvd.nist.gov/vuln/detail/CVE-2017-12149
- https://bugzilla.redhat.com/show_bug.cgi?id=1486220
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2017-12149
cwe-id: CWE-502
tags: java,rce,deserialization,kev,vulhub,cve,cve2017,jboss
requests:
- raw:
- |
POST /invoker/JMXInvokerServlet/ HTTP/1.1
Host: {{Hostname}}
Content-Type: application/octet-stream
{{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
- |
POST /invoker/EJBInvokerServlet/ HTTP/1.1
Host: {{Hostname}}
Content-Type: application/octet-stream
{{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
matchers-condition: and
matchers:
- type: word
part: body
words:
- "ClassCastException"
- type: word
part: header
words:
- "application/x-java-serialized-object"
# Enhanced by mp on 2022/05/11