JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization

id: CVE-2017-7504

info:
  name: JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization
  author: Jayachandran
  severity: critical
  description: |
    The JMS over HTTP Invocation Layer in JBossMQ, as implemented in HTTPServerILServlet.java in JBoss Application Server (AS) 4.x and earlier, does not properly restrict the classes that can be deserialized from the raw POST body. This allows remote attackers to execute arbitrary code or cause a denial of service (application crash or other impacts) via crafted serialized objects, due to insecure Java object deserialization.
  remediation: |
    Upgrade JBoss AS to a supported EAP version, or remove the jbossmq-httpil.sar deployment if JMS-over-HTTP is not required.
  reference:
    - https://github.com/vulhub/vulhub/blob/master/jboss/CVE-2017-7504/README.md
    - https://nvd.nist.gov/vuln/detail/CVE-2017-7504
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-7504
    cwe-id: CWE-502
    epss-score: 0.29323
    epss-percentile: 0.9803
    cpe: cpe:2.3:a:redhat:jboss_application_server:4.0.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: redhat
    product: jboss_application_server
    shodan-query: http.title:"JBoss"
    fofa-query: app="JBoss"
  tags: cve,cve2017,redhat,jboss,jbossmq,deserialization,rce

http:
  - method: POST
    path:
      - "{{BaseURL}}/jbossmq-httpil/HTTPServerILServlet"
    headers:
      Content-Type: application/octet-stream
    body: "{{base64_decode(\"rO0ABXQABWhlbGxv\")}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "cannot be cast to org.jboss.mq.il.http.HTTPILRequest"
          - "java.lang.ClassCastException"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100ebe9fd0db068ee48984ea867c3e9ee4f69a922d01ac23b314d554ffdc0db27ec022056c57477c1d410e0e4a5d4ee8842207c7461a2bd4f39fd7fbab5deae54b0d85d:922c64590222798bb761d5b6d8e72950