Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2017-12149

Quick assessment

Affected
Red Hat, Inc. jbossas
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Red Hat JBoss Enterprise Application Platform（EAP）是美国红帽（Red Hat）公司的一套开源、基于J2EE的中间件平台。该平台主要用于构建、部署和托管Java应用程序与服务。Jboss Application Server是其中的一款基于JavaEE的开源的应用服务器。 Red Hat Jboss EAP 5.0版本中附带的Jboss Application Server存在远程代码执行漏洞。远程攻击者可借助特制的序列化数据利用该漏洞在受影响应用程序上下文

AI Predicted 9.8 Difficulty: Easy KEV · Ransomware EPSS 90.71% · P100

Affected Version Matrix 1

VendorProduct Version RangeStatus
Red Hat, Inc. jbossas n/a affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2017-12149

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat JBoss Enterprise Application Platform Jboss Application Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat JBoss Enterprise Application Platform（EAP）是美国红帽（Red Hat）公司的一套开源、基于J2EE的中间件平台。该平台主要用于构建、部署和托管Java应用程序与服务。Jboss Application Server是其中的一款基于JavaEE的开源的应用服务器。 Red Hat Jboss EAP 5.0版本中附带的Jboss Application Server存在远程代码执行漏洞。远程攻击者可借助特制的序列化数据利用该漏洞在受影响应用程序上下文
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat, Inc. jbossas n/a -

II. Public POCs for CVE-2017-12149

# POC Description Source Link Shenlong Link
1 CVE-2017-12149 JBOSS as 6.X反序列化(反弹shell版) https://github.com/sevck/CVE-2017-12149 POC Details
2 CVE-2017-12149 jboss反序列化 可回显 https://github.com/yunxu1/jboss-_CVE-2017-12149 POC Details
3 CVE-2017-12149 JBOSS RCE (TESTED) https://github.com/1337g/CVE-2017-12149 POC Details
4 Jboss Java Deserialization RCE (CVE-2017-12149) https://github.com/jreppiks/CVE-2017-12149 POC Details
5 JBoss CVE-2017-12149 (Insecure Deserialization - RCE) Exploitation Lab. https://github.com/Xcatolin/jboss-deserialization POC Details
6 None https://github.com/VVeakee/CVE-2017-12149 POC Details
7 None https://github.com/MrE-Fog/jboss-_CVE-2017-12149 POC Details
8 Update of https://github.com/1337g/CVE-2017-12149 to work with python3 https://github.com/JesseClarkND/CVE-2017-12149 POC Details
9 None https://github.com/zesnd/cve-2017-12149 POC Details
10 Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12149.yaml POC Details
11 None https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/JBoss%205.x6.x%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E%20CVE-2017-12149.md POC Details
12 https://github.com/vulhub/vulhub/blob/master/jboss/CVE-2017-12149/README.md POC Details
13 None https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/JBoss%205.x%206.x%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E%20CVE-2017-12149.md POC Details
14 None https://github.com/galois17/cve-2017-12149-playground POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2017-12149

请登录查看更多情报信息。

Vendor Advisories for CVE-2017-12149 (3)

Other References for CVE-2017-12149 (1)

IV. Related Vulnerabilities

Same product: jbossas
Same vendor: Red Hat, Inc.
Same weakness: CWE-502

V. Comments for CVE-2017-12149

No comments yet

Leave a comment