Bug 2337620 (CVE-2025-23367)

Summary:	CVE-2025-23367 org.wildfly.core:wildfly-server: Wildfly improper RBAC permission
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	asoldano, bbaranow, bmaxwell, boliveir, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dhanak, dkreling, dosoudil, drichtar, ecerquei, fjuma, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jkoops, jrokos, kverlaen, lgao, mnovotny, mosmerov, msochure, msvehla, nwallace, pdelbell, pdrozd, peholase, pesilva, pjindal, pmackay, pskopek, rguimara, rmartinc, rowaters, rstancel, rstepani, security-response-team, smaestri, sthorger, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2025-03-03

Description OSIDB Bzimport 2025-01-14 15:30:59 UTC

When the authorization to control management operations is secured using the Role Based Access Control provider a user without the required privileges can suspend or resume the server.

A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server.

The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

When a server is suspended, the server will stop receiving user requests. The resume handle does the opposite; it will cause a suspended server to start accepting user requests.


Standalone server (Domain mode is not affected).
RBAC access control must be enabled with RBAC provider.
There is a user with a Monitor or Auditor role.

Comment 2 errata-xmlrpc 2025-04-01 13:06:52 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2025:3467 https://access.redhat.com/errata/RHSA-2025:3467

Comment 3 errata-xmlrpc 2025-04-01 13:10:04 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2025:3465 https://access.redhat.com/errata/RHSA-2025:3465

Comment 4 errata-xmlrpc 2025-04-17 14:31:27 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Via RHSA-2025:3989 https://access.redhat.com/errata/RHSA-2025:3989

Comment 5 errata-xmlrpc 2025-04-17 14:31:50 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Via RHSA-2025:3990 https://access.redhat.com/errata/RHSA-2025:3990

Comment 6 errata-xmlrpc 2025-04-17 14:38:12 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2025:3992 https://access.redhat.com/errata/RHSA-2025:3992

Comment 7 errata-xmlrpc 2025-05-06 14:28:07 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2025:4552 https://access.redhat.com/errata/RHSA-2025:4552

Comment 8 errata-xmlrpc 2025-05-06 14:29:52 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2025:4550 https://access.redhat.com/errata/RHSA-2025:4550

Comment 9 errata-xmlrpc 2025-05-06 14:30:34 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2025:4548 https://access.redhat.com/errata/RHSA-2025:4548

Comment 10 errata-xmlrpc 2025-05-06 14:30:56 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2025:4549 https://access.redhat.com/errata/RHSA-2025:4549