Fedora Account System
Red Hat Associate
Red Hat Customer
A remote user authenticated as ‘deployer’ account can import and deploy a malicious archive file from an untrusted source outside the intended control environment. In this specific case, the attacker leveraged WildFly (open source) libraries to craft a Java project that enabled them to perform an HTTP POST request to upload and deploy the malicious archive file from the untrusted source. In this particular scenario, the archive file is a WAR that contains a “read.jsp” page. Once the attacker uploads this file, they can leverage it to exploit other vulnerabilities, such as Arbitrary File Read, as dimostrated in this case.
This is not a vulnerability, this is the nature of an application server handling deployments. The nature of deployments mean that they are bundles of code that will be executed by the application server process, as they are executed by the application server process these deployments have the same privileges as the user running the application server. Deployments can only be deployed to the application server via the management interface or by directly copying it to the application server's directories. Within our default out of the box configuration the management interfaces are configured to be accessible over the loopback address only and require authentication. The default configuration does not contain default users with remote access to the application server. Additionally the application server provides a role based access control mechanism that can be enabled to restrict sensitive operations to users that have been granted specific roles. As the report identifies the ability to deploy to the application server is effectively a high privilege as it enables new code to be deployed to the running process, however it is the responsibility of the administrator to update the configuration to meet their operational needs. On updating the default configuration it is advisable to enable role based access control to enable authorization decisions to be applied to the management operations. If opening up the management interfaces to be accessible over other interfaces other than the loopback address the administrator should consider how accessible this needs to be and consider other solutions such as firewall rules to restrict access to trusted networks only. Finally the deployer role should only be granted to users who can be trusted with this responsibility and who will keep their credentials secure. As described this issue would suggest an administrator has opened up access to the management interface to untrusted destinations and has granted the deployer role either to a user who can not be trusted or who has somehow leaked their credentials.