CVE-2010-1428
Red Hat JBoss Information Disclosure Vulnerability
Description
CVE-2010-1428 is an information disclosure vulnerability in the Red Hat JBoss Application Server Web Console that allows unauthenticated remote attackers to access sensitive information by exploiting an incomplete HTTP verb restriction. While access to the Web Console (/web-console) is blocked by default, the access control mechanism only restricts GET and POST HTTP methods, allowing attackers to use alternative HTTP verbs (such as HEAD, PUT, or DELETE) to bypass the restriction and reach the console. CISA has confirmed active exploitation and flagged CVE-2010-1428 as associated with ransomware campaigns. With an EPSS percentile of 98.5%, this vulnerability is among the most frequently exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| redhat | jboss enterprise application platform | 4.2.0; 4.3.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://marc.info/?l=bugtraq&m=132698550418872&w=2(Exploit, Mailing List)
- http://secunia.com/advisories/39563(Broken Link, Vendor Advisory)
- http://securitytracker.com/id?1023917(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/39710(Broken Link, Third Party Advisory, VDB Entry)
- http://www.vupen.com/english/advisories/2010/0992(Broken Link, Vendor Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=585899(Issue Tracking)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58148(Third Party Advisory, VDB Entry)
- https://rhn.redhat.com/errata/RHSA-2010-0376.html(Broken Link, Vendor Advisory)
- https://rhn.redhat.com/errata/RHSA-2010-0377.html(Broken Link)
- https://rhn.redhat.com/errata/RHSA-2010-0378.html(Broken Link)
- https://rhn.redhat.com/errata/RHSA-2010-0379.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1428(Broken Link)
Weakness Type
Since no specific CWE has been assigned to CVE-2010-1428, the underlying weakness type remains formally unspecified. However, the vulnerability is clearly an authentication bypass through HTTP verb tampering, where access control is applied only to GET and POST methods but not to other HTTP verbs. This is a form of improper access control that fails to consistently enforce restrictions across all possible request methods to a protected resource.
Impact Analysis
CVE-2010-1428 allows unauthenticated remote attackers to access the JBoss Application Server Web Console, which exposes sensitive administrative information about the application server configuration, deployed applications, and runtime environment. The vulnerability is remotely exploitable over the network with no authentication required, no user interaction needed, and low attack complexity — an attacker simply needs to send HTTP requests using methods other than GET or POST. The exposed information can include server configuration details, deployed application names, data source configurations, JMX bean information, and other administrative data that facilitates further attacks. CISA's ransomware association indicates this vulnerability has been used as part of multi-stage attacks where the information gained from the Web Console enables subsequent exploitation and ultimately ransomware deployment. The EPSS percentile of 98.5% confirms the high frequency of exploitation in real-world attacks.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2010-1428 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 15, 2022. CISA has flagged this vulnerability as associated with ransomware campaigns. The EPSS percentile of 98.5% places it among the most exploited CVEs. The HTTP verb tampering technique required to exploit this vulnerability is trivial — it requires only basic HTTP request manipulation — making it accessible to attackers of all skill levels. JBoss Application Server was widely deployed in enterprise environments, and exposed administrative interfaces on internet-facing instances have been a persistent target for mass exploitation campaigns.
Remediation
- Apply security updates from Red Hat that address CVE-2010-1428. CISA's required action is to apply updates per vendor instructions.
- Ensure the JBoss Web Console access control restricts all HTTP methods, not just GET and POST. Configure the security constraints in the web application's deployment descriptor to cover all HTTP verbs.
- Remove or disable the Web Console entirely on production JBoss instances where it is not required for operational purposes.
- Place the JBoss Application Server behind a reverse proxy or web application firewall (WAF) that can enforce method-based access controls independently of the application server.
- Restrict network access to JBoss administrative interfaces (including the Web Console and JMX Console) to authorized management networks only, ensuring they are never directly exposed to the internet.
Technical Details
CVE-2010-1428 exploits an incomplete access control implementation in the JBoss Application Server Web Console. The Web Console (/web-console) provides a web-based interface for viewing JBoss server status, deployed applications, and configuration details. By default, access to this console is restricted, but the restriction is implemented through a security constraint that only applies to GET and POST HTTP methods. This means that sending the same requests using alternative HTTP verbs (HEAD, PUT, DELETE, OPTIONS, or custom methods) bypasses the access control entirely, as the security constraint does not match these methods and the request is processed without authentication. The attack is straightforward: an attacker sends HTTP requests to the Web Console endpoints using a non-standard HTTP method, and the server responds with the full console content. This is a classic HTTP verb tampering attack that exploits the common misconfiguration of applying security constraints only to expected HTTP methods.
Frequently Asked Questions
Is CVE-2010-1428 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2010-1428 and has flagged it as associated with ransomware campaigns. The EPSS percentile of 98.5% confirms very high exploitation activity. The trivial nature of the HTTP verb tampering exploit makes it accessible to a wide range of attackers.
What products are affected by CVE-2010-1428?
CVE-2010-1428 affects the Red Hat JBoss Application Server, specifically the Web Console component. All versions that use the default HTTP verb-restricted access control for the Web Console are vulnerable until patched.
How do I fix CVE-2010-1428?
Apply Red Hat security updates that address CVE-2010-1428. Additionally, configure security constraints to cover all HTTP methods, not just GET and POST. Ideally, disable the Web Console on production systems and restrict network access to administrative interfaces.
How severe is CVE-2010-1428?
CVE-2010-1428 has an EPSS percentile of 98.5% and is associated with ransomware campaigns. While it is an information disclosure vulnerability, the exposed administrative information enables further exploitation. The trivial exploit mechanism and the sensitive data exposed make it a critical finding in any JBoss deployment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.