Run a command somewhere in the home of Beijing

Run a command somewhere in the home of Beijing

RT

Detailed description:

Jboss invoker/JMXInvokerServlet Code Execution

The http://oa.juran.com.cn: 8086/invoker/JMXInvokerServlet

Proof of vulnerability:

Solution:

Security suggestion: add an access password to the jmx-console and restrict access to the public network. Check whether the version has any vulnerabilities and whether the upgrade is required.

1. Find the jmx-console.war directory edit WEB-INF/web. xml file under $ {jboss. server. home. dir}/deploy to remove the comments of the security-constraint block so that it works.

2. Edit WEB-INF/classes/jmx-console-users.properties or server/default/conf/props/jmx-console-users.properties (version> = 4.0.2) and.

WEB-INF/classes/jmx-console-roles.properties or server/default/conf/props/jmx-console-roles.properties (version> = 4.0.2) add user name and password.

3. Edit the WEB-INF/jboss-web.xml to remove the comments for the security-domain block, the security-domain value ing file is the login-config.xml (which defines the login authorization method ).