Vulnerabilities > CVE-2010-1871 - Expression Language Injection vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 1 | |
Application | 3 | |
OS | 2 |
Common Weakness Enumeration (CWE)
Exploit-Db
description | JBoss Seam 2 File Upload and Execute. CVE-2010-1871. Remote exploit for jsp platform |
id | EDB-ID:36653 |
last seen | 2016-02-04 |
modified | 2015-04-06 |
published | 2015-04-06 |
reporter | metasploit |
source | https://www.exploit-db.com/download/36653/ |
title | JBoss Seam 2 File Upload and Execute |
Metasploit
description JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. This modules also has been tested successfully against IBM WebSphere 6.1 running on iSeries. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured. id MSF:AUXILIARY/ADMIN/HTTP/JBOSS_SEAM_EXEC last seen 2020-04-25 modified 2019-09-24 published 2011-11-10 references https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1871 reporter Rapid7 source https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/admin/http/jboss_seam_exec.rb title JBoss Seam 2 Remote Command Execution description Versions of the JBoss Seam 2 framework < 2.2.1CR2 fails to properly sanitize inputs to some JBoss Expression Language expressions. As a result, attackers can gain remote code execution through the application server. This module leverages RCE to upload and execute a given payload. Versions of the JBoss application server (AS) admin-console are known to be vulnerable to this exploit, without requiring authentication. Tested against JBoss AS 5 and 6, running on Linux with JDKs 6 and 7. This module provides a more efficient method of exploitation - it does not loop to find desired Java classes and methods. id MSF:EXPLOIT/MULTI/HTTP/JBOSS_SEAM_UPLOAD_EXEC last seen 2020-05-26 modified 2017-08-29 published 2015-02-18 references reporter Rapid7 source https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/jboss_seam_upload_exec.rb title JBoss Seam 2 File Upload and Execute
Nessus
NASL family | Red Hat Local Security Checks |
NASL id | REDHAT-RHSA-2010-0564.NASL |
description | Updated jboss-seam2 packages that fix one security issue are now available for JBoss Enterprise Application Platform 4.3 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. [Updated 28 July 2010] The CVE-2010-1871 description has been updated to reflect that an attacker does not need to be authenticated to exploit this issue. No changes have been made to the packages. The JBoss Seam Framework is an application framework for building web applications in Java. An input sanitization flaw was found in the way JBoss Seam processed certain parametrized JBoss Expression Language (EL) expressions. A remote attacker could use this flaw to execute arbitrary code via a URL, containing appended, specially crafted expression language parameters, provided to certain applications based on the JBoss Seam framework. Note: A properly configured and enabled Java Security Manager would prevent exploitation of this flaw. (CVE-2010-1871) Red Hat would like to thank Meder Kydyraliev of the Google Security Team for responsibly reporting this issue. Users of jboss-seam2 should upgrade to these updated packages, which contain a backported patch to correct this issue. The JBoss server process must be restarted for this update to take effect. |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 63940 |
published | 2013-01-24 |
reporter | This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/63940 |
title | RHEL 4 / 5 : jboss-seam2 (RHSA-2010:0564) |
code |
|
Packetstorm
data source | https://packetstormsecurity.com/files/download/131287/jboss_seam_upload_exec.rb.txt |
id | PACKETSTORM:131287 |
last seen | 2016-12-05 |
published | 2015-04-03 |
reporter | vulp1n3 |
source | https://packetstormsecurity.com/files/131287/JBoss-Seam-2-File-Upload-Execute.html |
title | JBoss Seam 2 File Upload / Execute |
Redhat
advisories |
| ||||
rpms |
|
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 41994 CVE(CAN) ID: CVE-2010-1871 JBoss Seam是一个Java EE5框架,把JSF与EJB3.0组件合并在一起,从而为开发基于Web的企业应用程序提供一个最新的模式。 JBoss Seam处理某些参数化JBoss EL表达式的方式存在输入过滤漏洞。如果远程攻击者能够诱骗通过认证的JBoss Seam用户访问特制的网页,就可能导致执行任意代码。 JBoss Seam 2.0.2 SP1 JBoss Seam 2.0.2 JBoss Seam 2.0 厂商补丁: RedHat ------ RedHat已经为此发布了一个安全公告(RHSA-2010:0564-01)以及相应补丁: RHSA-2010:0564-01:Important: jboss-seam2 security update 链接:https://www.redhat.com/support/errata/RHSA-2010-0564.html |
id | SSV:20004 |
last seen | 2017-11-19 |
modified | 2010-07-29 |
published | 2010-07-29 |
reporter | Root |
title | JBoss Seam参数化EL表达式远程代码执行漏洞 |
References
- http://www.securitytracker.com/id?1024253
- http://www.securityfocus.com/bid/41994
- https://bugzilla.redhat.com/show_bug.cgi?id=615956
- http://www.vupen.com/english/advisories/2010/1929
- http://www.redhat.com/support/errata/RHSA-2010-0564.html
- http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60794
- https://security.netapp.com/advisory/ntap-20161017-0001/