Red Hat JBoss EAP - Deserialization of Untrusted Data

1.Abstract. JBoss EAP's JMX Invoker Servlet is exposed by default on port 8080/TCP. The communication employs serialized Java objects, encapsulated in HTTP requests and responses. The server deserializes these objects without checking the object type. This behavior can be exploited to cause a denial of service and potentially execute arbitrary code. The objects that can cause the DoS are based on known disclosed payloads taken from: - https://gist.github.com/coekie/a27cc406fc9f3dc7a70d Currently there is no known chain that allows code execution on JBoss EAP, however new chains are discovered every day. 2.Example Attack Session. Submit an authenticated POST request to the JMX Invoker Servlet URL (for example: http://localhost:8080/invoker/JMXInvokerServlet) with one of the following objects in the body of the request: * 01_BigString_limited.ser: it's a string object; the server will reply in a normal way (object size similar to the next one). * 02_SerialDOS_limited.ser: the application server will require about 2 minutes to execute the request with 100% CPU usage. * 03_BigString.ser: it's a string object; the server will reply in a normal way (object size similar to the next one). * 04_SerialDOS.ser: the application server will require an unknown amount of time to execute the request with 100% CPU usage. 3.Affected Platforms. This vulnerability affects versions 4 and 5 of JBoss EAP. 4.Fix. Red Hat will not fix the issue because JBoss EAP 4 is out of maintenance support and JBoss EAP 5 is close to the end of its maintenance period. 5.Proof Of Concept. See jboss_payload.zip and Example Attack Session above. 6.Timeline 06/10/2016 - First communication sent to Red Hat Security Response Team 07/10/2016 - Red Hat Security Response Team response, Bug 1382534 23/11/2016 - Security Advisory released Proof of Concept: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40842.zip