Vulnerabilities > CVE-2010-1871 - Expression Language Injection vulnerability in multiple products

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
redhat
netapp
CWE-917
nessus
exploit available
metasploit

Summary

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.

Exploit-Db

descriptionJBoss Seam 2 File Upload and Execute. CVE-2010-1871. Remote exploit for jsp platform
idEDB-ID:36653
last seen2016-02-04
modified2015-04-06
published2015-04-06
reportermetasploit
sourcehttps://www.exploit-db.com/download/36653/
titleJBoss Seam 2 File Upload and Execute

Metasploit

Nessus

NASL familyRed Hat Local Security Checks
NASL idREDHAT-RHSA-2010-0564.NASL
descriptionUpdated jboss-seam2 packages that fix one security issue are now available for JBoss Enterprise Application Platform 4.3 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. [Updated 28 July 2010] The CVE-2010-1871 description has been updated to reflect that an attacker does not need to be authenticated to exploit this issue. No changes have been made to the packages. The JBoss Seam Framework is an application framework for building web applications in Java. An input sanitization flaw was found in the way JBoss Seam processed certain parametrized JBoss Expression Language (EL) expressions. A remote attacker could use this flaw to execute arbitrary code via a URL, containing appended, specially crafted expression language parameters, provided to certain applications based on the JBoss Seam framework. Note: A properly configured and enabled Java Security Manager would prevent exploitation of this flaw. (CVE-2010-1871) Red Hat would like to thank Meder Kydyraliev of the Google Security Team for responsibly reporting this issue. Users of jboss-seam2 should upgrade to these updated packages, which contain a backported patch to correct this issue. The JBoss server process must be restarted for this update to take effect.
last seen2020-06-01
modified2020-06-02
plugin id63940
published2013-01-24
reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/63940
titleRHEL 4 / 5 : jboss-seam2 (RHSA-2010:0564)
code
#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2010:0564. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(63940);
  script_version("1.20");
  script_cvs_date("Date: 2019/10/25 13:36:15");

  script_cve_id("CVE-2010-1871");
  script_xref(name:"RHSA", value:"2010:0564");

  script_name(english:"RHEL 4 / 5 : jboss-seam2 (RHSA-2010:0564)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated jboss-seam2 packages that fix one security issue are now
available for JBoss Enterprise Application Platform 4.3 for Red Hat
Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System
(CVSS) base score, which gives a detailed severity rating, is
available from the CVE link in the References section.

[Updated 28 July 2010] The CVE-2010-1871 description has been updated
to reflect that an attacker does not need to be authenticated to
exploit this issue. No changes have been made to the packages.

The JBoss Seam Framework is an application framework for building web
applications in Java.

An input sanitization flaw was found in the way JBoss Seam processed
certain parametrized JBoss Expression Language (EL) expressions. A
remote attacker could use this flaw to execute arbitrary code via a
URL, containing appended, specially crafted expression language
parameters, provided to certain applications based on the JBoss Seam
framework. Note: A properly configured and enabled Java Security
Manager would prevent exploitation of this flaw. (CVE-2010-1871)

Red Hat would like to thank Meder Kydyraliev of the Google Security
Team for responsibly reporting this issue.

Users of jboss-seam2 should upgrade to these updated packages, which
contain a backported patch to correct this issue. The JBoss server
process must be restarted for this update to take effect."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2010-1871"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2010:0564"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected jboss-seam2 and / or jboss-seam2-docs packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'JBoss Seam 2 File Upload and Execute');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:jboss-seam2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:jboss-seam2-docs");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/08/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/07/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/24");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^(4|5)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 4.x / 5.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2010:0564";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL4", reference:"jboss-seam2-2.0.2.FP-1.ep1.24.el4")) flag++;
  if (rpm_check(release:"RHEL4", reference:"jboss-seam2-docs-2.0.2.FP-1.ep1.24.el4")) flag++;

  if (rpm_check(release:"RHEL5", reference:"jboss-seam2-2.0.2.FP-1.ep1.24.el5")) flag++;
  if (rpm_check(release:"RHEL5", reference:"jboss-seam2-docs-2.0.2.FP-1.ep1.24.el5")) flag++;

  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "jboss-seam2 / jboss-seam2-docs");
  }
}

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/131287/jboss_seam_upload_exec.rb.txt
idPACKETSTORM:131287
last seen2016-12-05
published2015-04-03
reportervulp1n3
sourcehttps://packetstormsecurity.com/files/131287/JBoss-Seam-2-File-Upload-Execute.html
titleJBoss Seam 2 File Upload / Execute

Redhat

advisories
rhsa
idRHSA-2010:0564
rpms
  • jboss-seam2-0:2.0.2.FP-1.ep1.24.el4
  • jboss-seam2-0:2.0.2.FP-1.ep1.24.el5
  • jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el4
  • jboss-seam2-docs-0:2.0.2.FP-1.ep1.24.el5

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 41994 CVE(CAN) ID: CVE-2010-1871 JBoss Seam是一个Java EE5框架,把JSF与EJB3.0组件合并在一起,从而为开发基于Web的企业应用程序提供一个最新的模式。 JBoss Seam处理某些参数化JBoss EL表达式的方式存在输入过滤漏洞。如果远程攻击者能够诱骗通过认证的JBoss Seam用户访问特制的网页,就可能导致执行任意代码。 JBoss Seam 2.0.2 SP1 JBoss Seam 2.0.2 JBoss Seam 2.0 厂商补丁: RedHat ------ RedHat已经为此发布了一个安全公告(RHSA-2010:0564-01)以及相应补丁: RHSA-2010:0564-01:Important: jboss-seam2 security update 链接:https://www.redhat.com/support/errata/RHSA-2010-0564.html
idSSV:20004
last seen2017-11-19
modified2010-07-29
published2010-07-29
reporterRoot
titleJBoss Seam参数化EL表达式远程代码执行漏洞