CVE-2010-1428: Red Hat JBoss - Web/JMX Console Access

id: CVE-2010-1428

info:
  name: Red Hat JBoss - Web/JMX Console Access
  author: Jayachandran from Securin Labs (https://securin.io)
  severity: high
  description: |
    Red Hat JBoss Enterprise Application Platform (EAP) can expose the Web Console, JMX Console, and JMXInvokerServlet without authentication, allowing remote attackers to reach admin dashboards and interact with MBeans, leading to full server compromise.
  impact: |
    Attackers can retrieve sensitive information by bypassing access controls, leading to information disclosure.
  remediation: |
    Restrict access to /web-console, /jmx-console and /invoker, and enforce authentication on the JBoss management interfaces.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2010-1428
    - https://access.redhat.com/security/cve/CVE-2010-1428
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.5
    cve-id: CVE-2010-1428
    epss-score: 0.52654
    epss-percentile: 0.98975
    cwe-id: CWE-306
  metadata:
    verified: false
    max-request: 3
    vendor: redhat
    product: jboss_enterprise_application_platform
    shodan-query:
      - http.html:"/jmx-console/"
      - http.title:"jboss"
      - cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
    fofa-query: 'title="JBoss" && body="/jmx-console/"'
  tags: cve,cve2010,jboss,redhat,unauth,exposure,auth-bypass,kev,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/jmx-console/"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "JMX Agent View"
          - "jboss.system:type"
          - "HtmlAdaptor?action"
        condition: or

  - method: GET
    path:
      - "{{BaseURL}}/web-console/"
      - "{{BaseURL}}/web-console/ServerInfo.jsp"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "JBoss Management Console"
          - "org.jboss.console"
        condition: or

  - method: GET
    path:
      - "{{BaseURL}}/invoker/JMXInvokerServlet"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "application/x-java-serialized-object"
# digest: 4a0a00473045022100ee0dbd05770d93b0dd0508f51b1ef74d2c11e3cc4ca7c4f1ef54fbe192daacd5022044429bd26bdd4157f5d9b739646363071c98b0109e12296e159b28de88cbce6c:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.