Loading vulnerability…
JBossMappingManager Default Security Domain Authorization Bypass
CVE-2014-7827 is an incorrect-authorization vulnerability in JBoss Security's org.jboss.security.plugins.mapping.JBossMappingManager. When processing an undefined security domain, the component can fall back to an available default security domain rather than enforcing the intended application domain. This can load an incorrect security context. The condition is exposed when the SAML2 STS Login Module is used because PicketLink Trust SecurityActions defines the context with a hardcoded default value.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated user holding valid credentials in the default security domain can perform actions that should be unavailable in the intended application security domain if the user also holds a role valid in that application domain. The result is an authorization bypass across security-domain boundaries.
If you can’t patch tonight, do this now.
Until patched, avoid configurations that permit undefined security domains to resolve to a default domain. Explicitly define and validate application security-domain configuration, and avoid use of the affected SAML2 STS Login Module configuration where practical. Restrict default-domain accounts so they do not hold roles recognized by other application security domains.
Patch, then assume compromise.
Install the applicable vendor-fixed release. Red Hat corrected the issue in JBoss Enterprise Application Platform 6.3.3 and in JBoss BPM Suite and JBoss BRMS 6.1.0. For affected PicketLink Federation 2.5 deployments, upgrade to 2.5.3.SP14 or a later 2.5 release. Restart the JBoss server process after applying updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.