CVE-2017-12149
Red Hat JBoss Application Server Remote Code Execution Vulnerability
Description
CVE-2017-12149 is a critical-severity deserialization of untrusted data vulnerability in Red Hat JBoss Application Server, as shipped with Red Hat Enterprise Application Platform 5.2. The vulnerability exists in the doFilter method of the ReadOnlyAccessFilter in the HTTP Invoker, which does not restrict classes for deserialization, allowing an attacker to execute arbitrary code via crafted serialized data. CISA has added CVE-2017-12149 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and this vulnerability is known to be used in ransomware campaigns. With an EPSS score of 94.29% (99.94th percentile), this JBoss deserialization vulnerability has a near-certain probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| redhat | jboss enterprise application platform | -; 5.0.0; 5.0.1; 5.1.0; 5.1.1; 5.1.2; 5.2.0; 5.2.1; 5.2.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/100591(Broken Link, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2018:1607(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:1608(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=1486220(Issue Tracking)
- https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
Deserialization of Untrusted Data occurs when an application deserializes data from an untrusted source without sufficient verification. In Red Hat JBoss Application Server, the HTTP Invoker's ReadOnlyAccessFilter performs deserialization without restricting which classes can be instantiated, allowing attackers to craft malicious serialized Java objects (gadget chains) that trigger arbitrary code execution when deserialized by the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2017-12149 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing the highest severity tier. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and demands no user interaction — making it trivially exploitable. Confidentiality (High): attackers can access any data on the JBoss server and connected systems. Integrity (High): complete modification of application data, configurations, and deployed applications is possible. Availability (High): full denial of service through system disruption or destruction. The EPSS score of 94.29% places this in the 99.94th percentile, confirming near-certain exploitation activity. Critically, this vulnerability is known to be leveraged in ransomware campaigns, significantly amplifying the business risk for affected organizations. The combination of network-accessible exploitation, no authentication requirements, and ransomware association makes CVE-2017-12149 one of the most dangerous vulnerabilities in JBoss environments.
Exploit Maturity
CVE-2017-12149 has a highly mature exploit landscape. Public exploit code and detailed exploitation methodology are available via GitHub (gottburgm/Exploits). CISA has confirmed active exploitation in the wild through the KEV catalog, with a remediation deadline of 2022-06-10. The ransomware usage flag is set to Known, indicating that this vulnerability has been actively leveraged in ransomware operations. The EPSS score of 94.29% (99.94th percentile) confirms near-certain exploitation probability, reflecting the combination of publicly available exploit tools, low exploitation complexity, and the attractiveness of JBoss servers as high-value targets for ransomware operators.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Red Hat has released RHSA-2018:1607 and RHSA-2018:1608 security advisories with specific patches for this vulnerability.
- Upgrade all affected JBoss Enterprise Application Platform instances. Affected versions include EAP 5.0.0 through 5.2.2. Migrate to a supported and patched version of JBoss EAP or consider migrating to a newer platform version that is no longer affected.
- As an immediate mitigation, disable or restrict access to the HTTP Invoker endpoint. Configure firewall rules to block external access to the JBoss HTTP Invoker paths, and implement network segmentation to isolate JBoss application servers from untrusted networks.
- Implement deserialization filtering by configuring Java deserialization allowlists that restrict which classes can be deserialized by the JBoss application server. Use tools like SerialKiller or NotSoSerial to harden the deserialization process.
- Monitor JBoss server logs for indicators of deserialization attacks, including unusual HTTP POST requests to the HTTP Invoker endpoint, unexpected Java class loading, and signs of ransomware activity such as mass file encryption or ransom notes.
Technical Details
CVE-2017-12149 targets the HTTP Invoker component in JBoss Application Server, specifically the doFilter method within the ReadOnlyAccessFilter class. The HTTP Invoker is designed to enable remote method invocation over HTTP, and accepts serialized Java objects as input. The vulnerability exists because the ReadOnlyAccessFilter does not implement any class restriction or validation on the deserialization process, allowing an attacker to submit crafted serialized Java objects containing malicious gadget chains. When the server deserializes these objects, the gadget chains trigger arbitrary code execution with the privileges of the JBoss application server process. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the maximum exploitability score of 3.9, indicating a trivially exploitable network-accessible attack surface with no mitigating factors.
Frequently Asked Questions
Is CVE-2017-12149 being actively exploited?
Yes. CVE-2017-12149 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. This vulnerability is also known to be leveraged in ransomware campaigns. The EPSS score of 94.29% (99.94th percentile) indicates near-certain exploitation probability.
What products are affected by CVE-2017-12149?
CVE-2017-12149 affects Red Hat JBoss Enterprise Application Platform versions 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.1.2, 5.2.0, 5.2.1, and 5.2.2. The vulnerability is specifically in the HTTP Invoker's ReadOnlyAccessFilter component.
How do I fix CVE-2017-12149?
Apply the patches from Red Hat security advisories RHSA-2018:1607 and RHSA-2018:1608. Upgrade to a patched version of JBoss EAP. As an interim measure, restrict access to the HTTP Invoker endpoint and implement deserialization filtering.
How severe is CVE-2017-12149?
CVE-2017-12149 has a CVSS 3.1 score of 9.8 (CRITICAL) and is in the 99.94th percentile for exploitation probability. It is actively used in ransomware campaigns and requires no authentication to exploit, making it one of the most critical vulnerabilities in JBoss environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.