jboss-jmx-console-unauth: JBoss JMX Console - Unauthenticated Access

2026-01-08 JBoss JMX Console PoC Public

Description

Detected JBoss JMX Console was accessible without authentication. The exposed console provided complete access to all MBeans, including MainDeployer, which enabled arbitrary WAR file deployment, leading to remote code execution. Attackers could view the entire MBean tree, deploy malicious applications, and invoke administrative operations without valid credentials.

PoC

id: jboss-jmx-console-unauth

info:
  name: JBoss JMX Console - Unauthenticated Access
  author: 0x_Akoko
  severity: high
  description: |
    Detected JBoss JMX Console was accessible without authentication. The exposed console provided complete access to all MBeans, including MainDeployer, which enabled arbitrary WAR file deployment, leading to remote code execution. Attackers could view the entire MBean tree, deploy malicious applications, and invoke administrative operations without valid credentials.
  reference:
    - https://developer.jboss.org/wiki/SecureTheJmxConsole
    - https://www.invicti.com/web-application-vulnerabilities/jboss-jmx-console-unrestricted-access
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.0
    cwe-id: CWE-306
    cpe: cpe:2.3:a:redhat:jboss_application_server:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
  tags: jboss,unauth,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/jmx-console/HtmlAdaptor?action=displayMBeans"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "JMX Agent View", "ObjectName Filter", "service=MainDeployer")'
          - 'contains_any(body, "jboss.deployment", "jboss.system")'
          - '!contains_any(body, "j_security_check", "j_username", "j_password")'
        condition: and
# digest: 4a0a0047304502207e9536dc0222356fb10bb3743dcac8457a06c99daa350831222c32d777cb07a0022100a27616a38e9d5b04da8e60bda82cc0c56ed16059bfecee37d7a0dc2fdd3dbb62:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/jboss-jmx-console-unauth.yaml

References

Related Vulnerabilities