Vulnerability Details : CVE-2017-12149
Public exploit exists!
Used for ransomware!
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
Vulnerability category: Execute code
Products affected by CVE-2017-12149
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*
CVE-2017-12149 is in the CISA Known Exploited Vulnerabilities Catalog
This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
Red Hat JBoss Application Server Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2017-12149
Added on
2021-12-10
Action due date
2022-06-10
Exploit prediction scoring system (EPSS) score for CVE-2017-12149
93.81%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2017-12149
-
JBoss Vulnerability Scanner
First seen: 2020-04-26auxiliary/scanner/http/jboss_vulnscanThis module scans a JBoss instance for a few vulnerabilities. Authors: - Tyler Krpata - Zach Grace <@ztgrace>
CVSS scores for CVE-2017-12149
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | 2024-07-24 |
CWE ids for CVE-2017-12149
-
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
References for CVE-2017-12149
-
http://www.securityfocus.com/bid/100591
Red Hat Jboss Enterprise Application Platform CVE-2017-12149 Remote Code Execution VulnerabilityBroken Link;Third Party Advisory;VDB Entry
-
https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149
Exploits/CVE-2017-12149 at master · gottburgm/Exploits · GitHubThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:1607
RHSA-2018:1607 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1486220
1486220 – (CVE-2017-12149) CVE-2017-12149 jbossas: Arbitrary code execution via unrestricted deserialization in ReadOnlyAccessFilter of HTTP Invoker.Issue Tracking
-
https://access.redhat.com/errata/RHSA-2018:1608
RHSA-2018:1608 - Security Advisory - Red Hat Customer PortalThird Party Advisory
Jump to