Loading vulnerability…
CVE-2010-1871 is an expression-language injection vulnerability in JBoss Seam 2, including deployments of JBoss Enterprise Application Platform 4.3.0. Insufficient sanitization of attacker-controlled input used in JBoss Expression Language expressions permits a remote attacker to submit a crafted HTTP request and cause evaluation of arbitrary EL expressions. The condition can be escalated to arbitrary Java code or operating-system command execution through accessible Java capabilities, such as reflection. Later Seam versions included a blacklist for dangerous expressions, but simplistic string-based filtering was susceptible to bypass techniques.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit exploit module targeting JBoss Seam 2 (CVE-2010-1871). The exploit abuses improper input sanitization in JBoss Expression Language, allowing unauthenticated remote code execution via the admin-console web interface (default URI: /admin-console/login.seam, typically on port 8080). The module checks for vulnerability, then uploads a Java payload (as a .jar file) in chunks, writes a JSP stager to execute the payload, and triggers execution, providing the attacker with a shell or Meterpreter session. The exploit is operational and customizable, leveraging Metasploit's payload system. The only fingerprintable endpoint is the admin-console login page. The code is written in Ruby and structured as a standard Metasploit module.
This repository contains a single Metasploit auxiliary module: 'modules/auxiliary/admin/http/jboss_seam_exec.rb'. The module exploits a remote command execution vulnerability (CVE-2010-1871) in JBoss Seam 2, as used in JBoss EAP 4.3.0 for Red Hat Linux and IBM WebSphere 6.1 on iSeries. The exploit works by sending specially crafted HTTP GET requests to a user-specified URI (default: /seam-booking/home.seam), leveraging improper sanitization of JBoss Expression Language (EL) expressions to execute arbitrary system commands. The module first probes the target to determine the correct method indices for Java's Runtime.exec and getRuntime, then constructs a final payload to execute the attacker's command. The exploit requires the Java Security Manager to be misconfigured or disabled. The only code file is written in Ruby and is structured as a standard Metasploit module, making use of the Metasploit framework's HTTP client utilities. The main fingerprintable endpoint is the default URI '/seam-booking/home.seam', but this can be changed by the user. The exploit is operational and allows for arbitrary command execution on vulnerable targets.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A specific vulnerability included among the exploit targets used by the Gitpaste-12/X10-unix cryptomining worm.
A historical remote-code-execution vulnerability in the JBoss Seam Framework involving the actionOutcome parameter. It is cited as background; the primary case study concerns a separate, unnamed Nuxeo/Seam exploit chain.
An expression-language injection vulnerability in Seam Framework that can result in remote code execution.
A vulnerability targeted by SpeakUp to execute its malicious script (product not specified in the content).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.