JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization
The JMS over HTTP Invocation Layer in JBossMQ, as implemented in HTTPServerILServlet.java in JBoss Application Server (AS) 4.x and earlier, does not properly restrict the classes that can be deserialized from the raw POST body. This allows remote attackers to execute arbitrary code or cause a denial of service (application crash or other impacts) via crafted serialized objects, due to insecure Java object deserialization. References: https://github.com/vulhub/vulhub/blob/master/jboss/CVE-2017-7504/README.md https://nvd.nist.gov/vuln/detail/CVE-2017-7504 Remediation: Upgrade JBoss AS to a supported EAP version, or remove the jbossmq-httpil.sar deployment if JMS-over-HTTP is not required.
url