Bug 1534476 (CVE-2018-10682) - CVE-2018-10682 wildfly: Anonymous access via 9990 port allows RCE via war file upload
Summary: CVE-2018-10682 wildfly: Anonymous access via 9990 port allows RCE via war fil...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2018-10682
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1534478
TreeView+ depends on / blocked
 
Reported: 2018-01-15 10:42 UTC by Adam Mariš
Modified: 2024-09-05 11:28 UTC (History)
69 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2018-10-04 08:56:02 UTC
Embargoed:


Attachments (Terms of Use)

Description Adam Mariš 2018-01-15 10:42:32 UTC
It was found that TCP port 9990 on WildFly server is open by default with no authentication allowing remote attacker to upload malicious war file that gets automatically deployed on server.

Comment 1 Darran Lofthouse 2018-01-15 10:49:31 UTC
Do we have any information on the steps to reproduce?  

Port 9990 does have authentication on by default both for the JBoss CLI connections and for the HTTP requests to the /management context so we would need more information on the steps needed to bypass this that lead to a war file being deployed.

Comment 2 Adam Mariš 2018-01-15 10:52:44 UTC
Acknowledgments:

Name: Jean-marie Bourbon (Excellium-Services), Anthony Maia (Excellium-Services)

Comment 7 Adam Mariš 2018-10-04 08:56:29 UTC
Statement:

Red Hat Product Security does not consider this issue as a vulnerability. The default installation are by default secured which means that management interfaces are set to have an authentication mechanism. Even without security on the management interfaces there are other approaches that could be taken, as an example a proxy fronting the server could be taking over the configuration.  A second one could be the application server is running on an isolated device that does not allow network connections to it so only a local trusted process can communicate with it. Our default out of the box security considers that the server could be installed on a multi-user server so other users could inadvertently gain access if we had no security.  However in many cases the server will be installed on a single user workstation for developer use, in that case being able to switch off security is desirable so the admin console can be accessed without the need for user accounts. As we switch to the Elytron configuration it is also possible for an administrator to define anonymous authentication policies even if sasl-authentication-factory is not referenced. HTTP remains the same, it is either on or off, a user could however still implement a custom anonymous mechanism.


Note You need to log in before you can comment on or make changes to this bug.