Bug 1534476 (CVE-2018-10682)
| Summary: | CVE-2018-10682 wildfly: Anonymous access via 9990 port allows RCE via war file upload | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | amaris, asoldano, bbaranow, bdawidow, bkundal, bmaxwell, bmcclain, boliveir, brian.stansberry, bspyrkos, cdewolf, chazlett, csutherl, darran.lofthouse, dblechte, dfediuck, dimitris, dingyichen, dkreling, dosoudil, dpalmer, drichtar, drieden, eedri, fjuma, istudens, ivassile, iweiss, java-maint, jawilson, jkoops, jshepherd, lef, lgao, mgoldboi, mgoldman, michal.skrivanek, mosmerov, mperina, msochure, msvehla, myarboro, nwallace, pdrozd, peholase, pgier, pjindal, pkremens, pmackay, psakar, pskopek, pslavice, psotirop, puntogil, rmartinc, rnetuka, rowaters, rstancel, rsvoboda, sbonazzo, security-response-team, sherold, smaestri, sthorger, tom.jenkinson, twalsh, vtunka, ykaul, ylavi |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-04 08:56:02 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1534478 | ||
|
Description
Adam Mariš
2018-01-15 10:42:32 UTC
Do we have any information on the steps to reproduce? Port 9990 does have authentication on by default both for the JBoss CLI connections and for the HTTP requests to the /management context so we would need more information on the steps needed to bypass this that lead to a war file being deployed. Acknowledgments: Name: Jean-marie Bourbon (Excellium-Services), Anthony Maia (Excellium-Services) Statement: Red Hat Product Security does not consider this issue as a vulnerability. The default installation are by default secured which means that management interfaces are set to have an authentication mechanism. Even without security on the management interfaces there are other approaches that could be taken, as an example a proxy fronting the server could be taking over the configuration. A second one could be the application server is running on an isolated device that does not allow network connections to it so only a local trusted process can communicate with it. Our default out of the box security considers that the server could be installed on a multi-user server so other users could inadvertently gain access if we had no security. However in many cases the server will be installed on a single user workstation for developer use, in that case being able to switch off security is desirable so the admin console can be accessed without the need for user accounts. As we switch to the Elytron configuration it is also possible for an administrator to define anonymous authentication policies even if sasl-authentication-factory is not referenced. HTTP remains the same, it is either on or off, a user could however still implement a custom anonymous mechanism. |