HackDig : Dig high-quality web security articles for hacker

Red Hat JBoss EAP deserialization of untrusted data

2016-11-25 09:15
Security Advisory           @ Mediaservice.net Srl
(#05, 23/11/2016) Data Security Division

Title: Red Hat JBoss EAP deserialization of untrusted data
Application: JBoss EAP 5.2.X and prior versions
Description: The application server deserializes untrusted data via
the JMX Invoker Servlet. This can lead to a DoS via
resource exhaustion and potentially remote code
execution.
Author: Federico Dotta <federico.dotta () mediaservice net>
Maurizio Agazzini <inode () mediaservice net>
Vendor Status: Will not fix
CVE Candidate: The Common Vulnerabilities and Exposures project has
assigned
the name CVE-2016-7065 to this issue.
References: http://lab.mediaservice.net/advisory/2016-05-jboss.txt
http://lab.mediaservice.net/code/jboss_payload.zip
https://bugzilla.redhat.com/show_bug.cgi?id=1382534

1. Abstract.

JBoss EAP's JMX Invoker Servlet is exposed by default on port 8080/TCP.
The communication employs serialized Java objects, encapsulated in HTTP
requests and responses.

The server deserializes these objects without checking the object type.
This behavior can be exploited to cause a denial of service and
potentially execute arbitrary code.

The objects that can cause the DoS are based on known disclosed payloads
taken from:

- https://gist.github.com/coekie/a27cc406fc9f3dc7a70d

Currently there is no known chain that allows code execution on JBoss
EAP, however new chains are discovered every day.

2. Example Attack Session.

Submit an authenticated POST request to the JMX Invoker Servlet URL (for
example: http://localhost:8080/invoker/JMXInvokerServlet) with one of
the following objects in the body of the request:

* 01_BigString_limited.ser: it's a string object; the server will
reply in a normal way (object size similar to the next one).
* 02_SerialDOS_limited.ser: the application server will require
about 2 minutes to execute the request with 100% CPU usage.
* 03_BigString.ser: it's a string object; the server will
reply in a normal way (object size similar to the next one).
* 04_SerialDOS.ser: the application server will require an
unknown amount of time to execute the request with 100% CPU usage.

3. Affected Platforms.

This vulnerability affects versions 4 and 5 of JBoss EAP.

4. Fix.

Red Hat will not fix the issue because JBoss EAP 4 is out of maintenance
support and JBoss EAP 5 is close to the end of its maintenance period.

5. Proof Of Concept.

See jboss_payload.zip and Example Attack Session above.

6. Timeline

06/10/2016 - First communication sent to Red Hat Security Response Team
07/10/2016 - Red Hat Security Response Team response, Bug 1382534
23/11/2016 - Security Advisory released

Copyright (c) 2016 @ Mediaservice.net Srl. All rights reserved.

--
Maurizio Agazzini CISSP, CSSLP, OPST
Senior Security Advisor
@ Mediaservice.net Srl Tel: +39-011-32.72.100
Via Santorelli, 15 Fax: +39-011-32.46.497
10095 Grugliasco (TO) ITALY http://mediaservice.net/disclaimer

"C programmers never die. They are just cast into void"

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


Source: 341/voN/6102/erusolcsidlluf/gro.stsilces

Read:1381 | Comments:0 | Tags:No Tag

“Red Hat JBoss EAP deserialization of untrusted data”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud