Loading vulnerability…
JBoss EAP RBAC Maintainer Authorization Bypass
CVE-2014-7849 is an incorrect authorization vulnerability in the Role-Based Access Control implementation of Red Hat JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2. Authorization validation for certain administrative operations did not enforce all conditions required of the Maintainer role. Consequently, an authenticated user assigned that role could add, modify, or undefine a limited set of protected management attributes and values that should not have been writable by that role. EAP versions prior to 6.2.0 are not affected because they do not support RBAC.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A Maintainer-role user can bypass intended RBAC restrictions and alter or remove a limited set of protected configuration attributes. This compromises the integrity of affected JBoss EAP management configuration and may enable administrative changes outside the permissions intended for the Maintainer role. The documented impact is limited to the affected attributes; no direct confidentiality or availability impact is specified.
If you can’t patch tonight, do this now.
Until the update is installed, restrict assignment of the Maintainer role to fully trusted administrators and review existing Maintainer-role assignments. Limit access to JBoss management interfaces to authorized administrative users and monitor administrative configuration changes, particularly writes to protected attributes.
Patch, then assume compromise.
Upgrade affected JBoss EAP installations to the fixed 6.3.3 or applicable supported 6.3.z update. Red Hat addressed the issue through RHSA-2015:0215, RHSA-2015:0216, RHSA-2015:0217, and RHSA-2015:0218, according to the supported Red Hat Enterprise Linux platform. Apply relevant prerequisite errata and restart the JBoss server process after installation for the update to take effect.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.