Loading vulnerability…
JBoss EAP Domain Controller RBAC Propagation Privilege Escalation
CVE-2016-5406 is an improper privilege-management vulnerability in Red Hat JBoss Enterprise Application Platform (EAP) 7 domain management. In affected releases, the domain controller can fail to propagate administrative role-based access control (RBAC) configuration to certain slave hosts. The resulting inconsistency in administrative authorization policy can allow an authenticated remote user to obtain privileges beyond those intended by the domain-wide RBAC configuration.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can escalate administrative privileges within an affected JBoss EAP domain. This can compromise the confidentiality, integrity, and availability of domain-managed application-server resources, subject to the permissions granted by the improperly synchronized slave-host configuration.
If you can’t patch tonight, do this now.
Until the update can be installed, restrict access to EAP management interfaces to trusted, authorized administrators; minimize accounts with management permissions; review administrative RBAC assignments on each slave host for divergence from the domain-controller policy; and monitor management operations for unexpected privilege changes. These measures reduce exposure but do not correct the propagation defect.
Patch, then assume compromise.
Upgrade affected JBoss EAP deployments to the vendor-fixed EAP 7.0.2 packages or a later supported release containing the fix. Back up the EAP installation and deployed applications before updating. Restart the JBoss server process after installation so the corrected components and RBAC configuration handling take effect.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.