CVE-2017-7504

HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

41.02% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-502

Published

2017-05-19

Updated

2024-08-05

Proof-of-concept exploits (8)

• Sathyasri1/JavaDeserH2HC0★ · 2023-04-17
• gallopsec/JBossScan2★ · 2023-09-06
• ianxtianxt/CVE-2015-750122★ · 2020-02-21
• joaomatosf/JavaDeserH2HC520★ · 2022-03-11
• merlinepedra/JavaDeserH2HC0★ · 2022-06-27
• merlinepedra25/JavaDeserH2HC0★ · 2022-06-27
• ozkanbilge/Java-Reverse-Shell4★ · 2018-11-08
• wudidwo/CVE-2017-7504-poc0★ · 2024-11-20

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7504.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/jboss/CVE-2017-7504

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2017/CVE-2017-7504.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2017-12149
• CVE-2015-7501
• CVE-2017-10271
• CVE-2017-12615
• CVE-2017-3248
• CVE-2017-3506