CVE-2010-0738
Red Hat JBoss Authentication Bypass Vulnerability
Description
CVE-2010-0738 is an authentication bypass vulnerability in the JMX-Console web application of Red Hat JBoss Enterprise Application Platform that allows remote attackers to access the JMX Console by using HTTP methods other than GET and POST. The JMX-Console access control mechanism only restricts GET and POST requests, enabling attackers to bypass authentication entirely by sending requests with alternative HTTP verbs. Through the JMX Console, an attacker can deploy malicious applications, modify server configuration, and achieve full control over the JBoss Application Server. CISA has confirmed active exploitation and flagged CVE-2010-0738 as associated with ransomware campaigns. With an EPSS percentile of 99.6%, this is one of the most exploited vulnerabilities in the entire CVE database.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| redhat | jboss enterprise application platform | 4.2.0; 4.3.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- http://marc.info/?l=bugtraq&m=132129312609324&w=2(Exploit, Mailing List)
- http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35(Third Party Advisory)
- http://secunia.com/advisories/39563(Broken Link, Vendor Advisory)
- http://securityreason.com/securityalert/8408(Broken Link)
- http://securitytracker.com/id?1023918(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/39710(Broken Link, Third Party Advisory, VDB Entry)
- http://www.vupen.com/english/advisories/2010/0992(Broken Link, Vendor Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=574105(Issue Tracking)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58147(Third Party Advisory, VDB Entry)
- https://rhn.redhat.com/errata/RHSA-2010-0376.html(Broken Link)
- https://rhn.redhat.com/errata/RHSA-2010-0377.html(Broken Link)
- https://rhn.redhat.com/errata/RHSA-2010-0378.html(Broken Link)
- https://rhn.redhat.com/errata/RHSA-2010-0379.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0738(US Government Resource)
Weakness Type
Since no specific CWE has been assigned to CVE-2010-0738, the underlying weakness type remains formally unspecified. However, the vulnerability is an authentication bypass through HTTP verb tampering in the JMX-Console access control. The security filter only intercepts GET and POST methods, allowing any other HTTP method (HEAD, PUT, DELETE, OPTIONS) to pass through without authentication checks. This is a form of improper access control where security restrictions are not consistently applied across all request types.
Impact Analysis
CVE-2010-0738 provides unauthenticated remote attackers with full access to the JBoss JMX Console, which serves as the primary administrative interface for the application server. Through the JMX Console, an attacker can deploy WAR files containing malicious web shells, modify server configuration parameters, access data sources and database connections, view and modify deployed applications, and execute arbitrary code on the server. The vulnerability is remotely exploitable with no authentication required and minimal attack complexity — the attacker simply uses an HTTP method other than GET or POST. CISA's ransomware association indicates this vulnerability has been actively used in ransomware attack chains where initial JMX Console access enables deployment of ransomware payloads to the server. The EPSS percentile of 99.6% reflects the massive scale of real-world exploitation, particularly in internet-facing JBoss deployments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2010-0738 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 15, 2022. CISA has flagged this vulnerability as associated with ransomware campaigns, confirming its use in ransomware attack operations. The EPSS percentile of 99.6% places it in the top 0.4% of all CVEs for exploitation likelihood. The HTTP verb tampering technique is trivially simple to execute and has been widely documented. Mass exploitation campaigns targeting internet-exposed JBoss JMX Consoles have been observed repeatedly, with attackers deploying web shells and ransomware through the unauthenticated administrative access.
Remediation
- Apply security updates from Red Hat that address CVE-2010-0738. CISA's required action is to apply updates per vendor instructions.
- Configure the JMX-Console security constraints to apply to all HTTP methods, not just GET and POST. Update the web.xml deployment descriptor to include a wildcard or explicit list of all HTTP methods in the security constraint.
- Disable or remove the JMX-Console entirely on production JBoss instances where direct console access is not operationally required.
- Restrict network access to the JMX-Console to authorized management networks only using firewall rules, ensuring it is never accessible from the internet.
- Deploy a web application firewall (WAF) or reverse proxy in front of the JBoss instance to enforce authentication on all HTTP methods regardless of the application server's internal access controls.
Technical Details
CVE-2010-0738 exploits an authentication bypass in the JMX-Console web application of JBoss Enterprise Application Platform. The JMX-Console (accessible at /jmx-console) provides a web-based interface to the Java Management Extensions (JMX) MBeans, allowing full administrative control over the JBoss server. Access control for the JMX-Console is implemented via security constraints in the web.xml deployment descriptor, but these constraints are configured to apply only to GET and POST HTTP methods. When an attacker sends an HTTP request using a different method (such as HEAD, PUT, or OPTIONS), the request bypasses the security filter entirely and the JMX-Console responds with its full administrative interface. From the JMX-Console, the attacker can invoke MBeans to deploy WAR files, which is the most common exploitation technique — the attacker deploys a web shell packaged as a WAR file, then accesses the web shell to execute arbitrary commands on the server. This vulnerability is closely related to CVE-2010-1428, which exploits the same HTTP verb tampering technique against the JBoss Web Console.
Frequently Asked Questions
Is CVE-2010-0738 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2010-0738 and has flagged it as associated with ransomware campaigns. The EPSS percentile of 99.6% confirms it is one of the most exploited CVEs in the database. The trivial HTTP verb tampering technique makes exploitation accessible to attackers of all skill levels.
What products are affected by CVE-2010-0738?
CVE-2010-0738 affects the JMX-Console web application in Red Hat JBoss Enterprise Application Platform. All versions with the default HTTP method-restricted security configuration for the JMX-Console are vulnerable until properly patched or reconfigured.
How do I fix CVE-2010-0738?
Apply Red Hat security updates and reconfigure the JMX-Console security constraints to apply to all HTTP methods. Ideally, disable the JMX-Console on production systems and restrict all administrative interfaces to authorized management networks only.
How severe is CVE-2010-0738?
CVE-2010-0738 is a critical authentication bypass with an EPSS percentile of 99.6% and a confirmed ransomware association. Through the JMX Console, attackers can deploy malicious applications and execute arbitrary code on the server, making this effectively a remote code execution vulnerability through administrative interface compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.