The JMXInvokerHAServlet and EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform, Web Platform, BRMS Platform and SOA Platform do not require authentication by default in certain profiles. Exploitation requires that the interceptor lacks a properly configured second layer of authentication, or that another vulnerability is used to bypass that layer, and would let a remote attacker invoke MBean methods and execute arbitrary code.
The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.
First seen exploited 5 years after disclosure. Public exploit code (Exploit-DB) appeared 10 months after disclosure.
No high- or medium-confidence techniques. The 1 available link are lower confidence and listed below.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
Reports are matched by finding the exact id CVE-2012-0874 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
File Upload(CVE-2018-2894) Hadoop YARN ResourceManager Remote Command Execution Apache ActiveMQ Fileserver Multi Methods Directory Traversal(CVE-2016-3088) JBoss Seam 2 Framework Remote Code Execution (CVE-2010-1871) JBoss Enterprise Application Platform Invoker Servlets Remote Code Execution (CVE-2012-0874)
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.