Loading vulnerability…
JBoss Seam 2, including use in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, improperly sanitizes user-supplied input used in JBoss Expression Language (EL) expressions. A remote attacker can supply a crafted URL containing malicious EL input that is evaluated by the application, resulting in arbitrary code execution. The issue is only exploitable as a security vulnerability when the Java Security Manager is not properly configured, because that configuration determines whether dangerous operations performed through evaluated expressions are effectively constrained.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit exploit module targeting JBoss Seam 2 (CVE-2010-1871). The exploit abuses improper input sanitization in JBoss Expression Language, allowing unauthenticated remote code execution via the admin-console web interface (default URI: /admin-console/login.seam, typically on port 8080). The module checks for vulnerability, then uploads a Java payload (as a .jar file) in chunks, writes a JSP stager to execute the payload, and triggers execution, providing the attacker with a shell or Meterpreter session. The exploit is operational and customizable, leveraging Metasploit's payload system. The only fingerprintable endpoint is the admin-console login page. The code is written in Ruby and structured as a standard Metasploit module.
This repository contains a single Metasploit auxiliary module: 'modules/auxiliary/admin/http/jboss_seam_exec.rb'. The module exploits a remote command execution vulnerability (CVE-2010-1871) in JBoss Seam 2, as used in JBoss EAP 4.3.0 for Red Hat Linux and IBM WebSphere 6.1 on iSeries. The exploit works by sending specially crafted HTTP GET requests to a user-specified URI (default: /seam-booking/home.seam), leveraging improper sanitization of JBoss Expression Language (EL) expressions to execute arbitrary system commands. The module first probes the target to determine the correct method indices for Java's Runtime.exec and getRuntime, then constructs a final payload to execute the attacker's command. The exploit requires the Java Security Manager to be misconfigured or disabled. The only code file is written in Ruby and is structured as a standard Metasploit module, making use of the Metasploit framework's HTTP client utilities. The main fingerprintable endpoint is the default URI '/seam-booking/home.seam', but this can be changed by the user. The exploit is operational and allows for arbitrary command execution on vulnerable targets.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A specific vulnerability included among the exploit targets used by the Gitpaste-12/X10-unix cryptomining worm.
A vulnerability targeted by SpeakUp to execute its malicious script (product not specified in the content).
A vulnerability targeted by SpeakUp to enable execution (product not specified in the provided content).
A vulnerability targeted by SpeakUp for execution (as referenced in the content).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.