Vulnerability Note VU#632656

JBoss Application Server may not properly restrict access to the administrative interface

If JBoss is installed without using the advanced installer options, the JBoss security features will need to be configured manually. If a JBoss server is configured to allow unauthenticated access to the administrative interface, and is accessible from a remote network, then an attacker may be able to access and modify data on the server.

Note that it may be possible to enumerate vulnerable servers by using search engines.

II. Impact

Using the advanced installer options will configure JBoss to only allow authenticated administrative access.

Enable role based security

Enabling role based security may mitigate this vulnerability. See the SecureTheJmxConsole page on the JBoss wiki for more information.

Restrict access

Restricting access to the administrative interface to trusted hosts may mitigate this vulnerability. See the LimitAccessToCertainClients page on the JBoss wiki for more information.

Systems Affected

http://wiki.jboss.org/wiki/Wiki.jsp?page=SecureTheJmxConsole
http://wiki.jboss.org/wiki/Wiki.jsp?page=LimitAccessToCertainClients
http://www.jboss.com/
http://wiki.jboss.org/wiki/Wiki.jsp?page=SecureJBoss
http://archives.neohapsis.com/archives/bugtraq/2007-02/0347.html

Credit

This vulnerability was reported by Ben Dexter.

This document was written by Ryan Giobbi.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.