Loading vulnerability…
JBoss EAP Cross-Origin Server Log Download Resource Exhaustion
CVE-2016-8627 is an uncontrolled resource-consumption vulnerability in the server-log download feature of Red Hat JBoss Enterprise Application Platform (EAP). Vulnerable admin-cli versions make server log files downloadable through HTTP GET requests, allowing those requests to be initiated cross-origin. An attacker can induce a victim browser to repeatedly retrieve log files, causing server-side resource consumption and impairing normal EAP operation. Affected versions include admin-cli releases before 3.0.0.alpha25 and 2.2.1.cr2; fixes were delivered in JBoss EAP 7.0.4, EAP 6.4.13, and subsequent EAP 7.1 updates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes resource-starvation denial of service against the affected EAP server. Repeated cross-origin log-download requests can consume sufficient resources to degrade or impair normal service operation. The documented assessment identifies availability impact and does not identify confidentiality or integrity impact.
If you can’t patch tonight, do this now.
Until updates can be installed, restrict access to EAP management and server-log download functionality to trusted users and networks, and prevent untrusted web origins from causing authenticated users' browsers to access the log-download endpoint. Monitor for anomalous or repeated server-log download requests and apply rate limiting or request filtering where operationally feasible.
Patch, then assume compromise.
Apply the applicable Red Hat JBoss EAP security update. For EAP 7.0 deployments, upgrade from 7.0.3 to 7.0.4 or a later supported release. For EAP 6.4 deployments, upgrade from 6.4.12 to 6.4.13 or a later supported release. Apply the relevant vendor errata for the installed operating-system and EAP package variant, back up the EAP installation and deployed applications before updating, and restart affected services after installation where required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.