JBOSS Remote Code Execution Vulnerability

Author: safe3

By default, JBOSS has a background vulnerability, which occurs inJboss. deployment namespace

InAddURL () function,This function can remotely download and decompress a war package

Access http://www.safe3.com.cn: 8080/jmx-console/background, such

Find the drop-down list, as shown in.

Click flavor = URL, type = deployment.pdf to enter

Write the url of the war compressed file webshell in the input box, as shown in figure

Click the invoke execution interface to obtain a jsp webshell, as shown in figure

How to fix temporary vulnerabilities:Add an access password to the jmx-console

1. Find the jmx-console.war directory edit WEB-INF/web. xml file under $ {jboss. server. home. dir}/deploy to remove the comments of the security-constraint block so that it works

2. Edit WEB-INF/classes/jmx-console-users.properties or server/default/conf/props/jmx-console-users.properties (version> = 4.0.2) and WEB-INF/classes/jmx-console-roles.properties

Or server/default/conf/props/jmx-console-roles.properties (version> = 4.0.2) add user name and password

3. Edit the WEB-INF/jboss-web.xml to remove the comments for the security-domain block, the security-domain value ing file is the login-config.xml (which defines the login authorization method)