References https://blog.csdn.net/2301_82061181/article/details/142464730 https://blog.csdn.net/Beijing_L/article/details/148565757 https://www.cnblogs.com/sevck/p/4978901.html https://zone.huoxian.cn/d/1187-jboss https://cloud.tencent.com/developer/article/1904115 https://www.tdyun.com/study/networkMan/1262 https://zhuanlan.zhihu.com/p/368199176 https://blkstone.github.io/2017/12/29/cve-2013-4810-jboss-rce/ https://nvd.nist.gov/vuln/detail/CVE-2013-4810 https://www.exploit-db.com/exploits/28713 https://access.redhat.com/articles/545183 https://blog.csdn.net/weixin_42370743/article/details/116110273
Related VulnerabilitiesPoCCVE-2017-7504: JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java DeserializationPoCCVE-2015-7501: Red Hat JBoss - Insecure DeserializationPoCjboss-jmx-console-unauth: JBoss JMX Console - Unauthenticated AccessJBOSS Netty SMTP 未授权 命令注入漏洞PoCCVE-2010-1429: Red Hat JBoss Enterprise Application Platform - Sensitive Information DisclosurePoCCVE-2017-12149: Jboss Application Server - Remote Code ExecutionPoCCVE-2010-1871: JBoss CVE-2010-1871PoCCVE-2017-12149: Java/Jboss Deserialization [RCE]PoCCVE-2017-7504: JBoss 4.x JBossMQ JMS 反序列化漏洞PoCjmx-default-password: JBoss JMX Console Weak CredentialPoCjboss-xml-console-unauthorized: JBoss JMX Console Weak Credential DiscoveryPoCjboss-jbpm-default-login: JBoss jBPM Administration Console Default Login - Detect