Red Hat JBoss EAP 5.2.x Untrusted Data Deserialization
Posted by deepcore on November 29, 2016 – 5:20 am
JBoss EAP’s JMX Invoker Servlet is exposed by default on port 8080/TCP. The communication employs serialized Java objects, encapsulated in HTTP requests and responses. The server deserializes these objects without checking the object type. This behavior can be exploited to cause a denial of service and potentially execute arbitrary code.
Post a reply
You must be logged in to post a comment.