[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 31 Mar 2014 10:51:23 +1000
From: David Jorm <djorm@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: JBoss EJBInvokerServlet/JMXInvokerServlet confusion
On 03/29/2014 12:02 AM, Steven M. Christey wrote:
>
> There are several CVEs related to the lack of authentication for JBoss
> invoker servlets, but there's a bit of confusion and a likely
> duplicate.
>
> CVE-2012-0874 is associated with various Red Hat advisories that
> mention JMXInvokerHAServlet and EJBInvokerHAServlet - with "HA" in the
> name - in JBoss.
>
> The description for CVE-2013-4810 is currently focused on HP products,
> but it mentions EJBInvokerServlet and JMXInvokerServlet (different
> servlets without "HA" in the name). Through the associated ZDI
> advisory, this issue is associated with some exploit(s) authored by
> Andrea Micalizzi (rgod), who reported the issue in various products
> that utilize JBoss. In addition,
> https://access.redhat.com/site/articles/545183 - "Does CVE-2013-4810
> affect Red Hat JBoss products?" - clarifies that these servlets are
> "exposed without authentication on older, unsupported community
> releases of JBoss AS (WildFly) 4.x and 5.x."
>
> CVE-2013-4810 is used heavily with references to ZDI-13-229.
>
> The openness of JMXInvokerServlet is covered in a 2011-era disclosure
> in http://www.matasano.com/research/OWASP3011_Luca.pdf, although
> EJBInvokerServlet is not mentioned then.
>
> The key question is whether CVE-2013-4810 is a duplicate of an
> existing CVE that covers EJBInvokerServlet and JMXInvokerServlet, and
> if so, which CVE is it a duplicate of.
>
> It is not a duplicate of CVE-2012-0874, since that deals with the
> exposure of different servlets - the "HA" servlets - so is effectively
> a variant of the original issue.
>
> CVE-2007-1036 is heavily used. Although it does not mention
> EJBInvokerServlet or JMXInvokerServlet, it is related to insecure
> JBoss configuration. None of the commonly-associated references
> mention EJBInvokerServlet and JMXInvokerServlet, either. If we can
> clearly link CVE-2007-1036 with those servlets, then it becomes
> possible to reject CVE-2013-4810 as a duplicate.
>
> Original links such as
> http://wiki.jboss.org/wiki/Wiki.jsp?page=SecureJBoss are now gone,
> which is unfortunate because this is a "bridge reference" that is
> included in both CVE-2007-1036 and Red Hat's "Does CVE-2013-4810
> affect Red Hat JBoss products?" article.
> https://community.jboss.org/wiki/securethejmxconsole doesn't name the
> servlets.
>
> There is, at least, a Metasploit module that maps to CVE-2007-1036 and
> calls JMXInvokerServlet:
>
> https://www.rapid7.com/db/modules/exploit/multi/http/jboss_invoke_deploy
>
> There's still a question of EJBInvokerServlet - I haven't seen it
> mentioned in conjunction with CVE-2007-1036 yet.
>
> Also, it appears that there are mentions of other vectors besides
> servlets, e.g.
> http://archives.neohapsis.com/archives/bugtraq/2007-02/0356.html
>
> Red Hat, can you confirm that the scope of CVE-2007-1036 is the lack
> of authentication for both JMXInvokerServlet and EJBInvokerServlet?
>
>
> - Steve
Hi All
CVE-2007-1036 describes complete lack of authentication on JBoss admin
interfaces. CVE-2010-0738 describes the more specialized case of missing
authentication for the HEAD verb, and could be considered an incomplete
fix of CVE-2007-1036. CVE-2012-0874 describes the more specialized case
of missing authentication on some invoker servlets, and could be
considered an incomplete fix of CVE-2007-1036. To clarify the timeline
of CVE IDs:
CVE-2007-1036: By default, all admin interfaces in JBoss AS do not
require authentication. This includes all invoker servlets, HA or not.
Following this, supported JBoss products had authentication applied to
all admin interfaces by default. From the unsupported community release
of JBoss AS 7 onwards, authentication is also applied by default.
Unsupported community releases of JBoss AS <= 6.x never had
authentication applied by default, and they could be accurately said to
be vulnerable to CVE-2007-1036.
CVE-2010-0738: It was found that the authentication applied in supported
JBoss products does not cover the HEAD verb, allowing a HTTP verb
tampering attack.
CVE-2012-0874: It was found that the authentication applied in supported
JBoss products does not cover the HA servlets. This is not directly
exploitable, as a security interceptor still blocks unauthenticated access.
CVE-2013-4810: HP has been picking up unsupported JBoss AS releases that
expose CVE-2007-1036 [and by extension CVE-2010-0738 and CVE-2012-0874],
and did not ship patches for any of these CVE IDs. Once the issue was
reported via ZDI, CVE-2013-4810 was assigned.
Therefore CVE-2013-4810 does not relate to either unsupported JBoss AS
releases or supported JBoss products. It only relates to unsupported
JBoss AS releases as a duplicate of either CVE-2012-0874 or
CVE-2007-1036. Since the CVE-2013-4810 description pertains to invoker
servlets, I think it is a dupe of CVE-2012-0874, but I can see a
rational argument for considering it to be a dupe of the more general
case described by CVE-2007-1036.
Unfortunately the original "Secure JBoss" and "Secure the JMX Console"
links are now dead, but the content lives on here:
https://community.jboss.org/wiki/SecureJBoss
https://community.jboss.org/wiki/SecureTheJmxConsole
Note that one of the steps documented is to secure the invoker:
https://community.jboss.org/servlet/JiveServlet/download/12190-52-6400/jboss-securejmx.html
Although this content does not explicitly mention the EJB/JMX
InvokerServlets, it covers securing them.
Thanks
--
David Jorm / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
