CODEWITHSUNDEEP
javasecurityjakarta-eejboss
Mohamed Magdy
Mohamed Magdy

Reputation: 551

JBoss security issue

i am ruuning jboos on windows xp , found in the logs some one has deployed web app to jboss which enables him to open socket to my machine.

i don't understand how he could upload such WAR file to the deployment directory of jboss .

any ideas please ?

Upvotes: 2

Views: 772

Answers (2)

Tomasz Stanczak
Tomasz Stanczak

Reputation: 13164

AFAIR up to JBoss v4 you could just copy WARs to the deploy directory and let JBoss autodeploy them. Could it be that somebody were able to copy a file there perhaps over a network share?

Next it was possible to deploy web applications using JBoss Management Console - this is accessible over the network, is it opened on your machine? Did you change default user/password?

Upvotes: 1

Jurri
Jurri

Reputation: 318

The attacker may have exploited JMX console default configuration vulnerability (JBoss JIRA JBAS-8954). It is a well known vulnerability, so you should be able to find the remedy.

More on this issue:

Upvotes: 1

Related Questions