Loading vulnerability…
CVE-2017-12149 is a remote code execution vulnerability in JBoss Application Server as shipped with Red Hat Enterprise Application Platform 5.2. The flaw is in the HTTP Invoker component, specifically the doFilter method of ReadOnlyAccessFilter, which deserializes attacker-supplied data without restricting the classes that may be deserialized. Because untrusted serialized objects are accepted and processed, a remote attacker can supply a crafted serialized payload that triggers arbitrary code execution during deserialization.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a Python exploit script (jdspoc.py) targeting the JBoss Java Deserialization Remote Code Execution vulnerability (CVE-2017-12149). The exploit requires the attacker to have ysoserial.jar (a Java tool for generating malicious serialized objects) and Java installed locally. The script takes as input the target's IP and port (in the format IP:PORT), the command to execute, and optionally the protocol (HTTP/HTTPS) and path to ysoserial.jar. It generates a malicious Java serialized payload using the CommonsCollections1 gadget and sends it via a POST request to the /invoker/readonly endpoint on the target JBoss server. If the server is vulnerable, the supplied command is executed remotely. The repository structure is simple, consisting of a README.md describing the exploit and the main exploit script jdspoc.py. The exploit is operational, allowing arbitrary command execution on vulnerable targets.
This repository is an exploit toolkit for CVE-2017-12149, a remote code execution vulnerability in JBoss Application Server due to unsafe Java deserialization via the /invoker/readonly endpoint. The exploit is implemented in Java and includes a GUI (main.java) for user interaction, a payload generator (Payload.java) that crafts malicious serialized objects using Apache Commons Collections gadget chains, and a network module (doPost.java) that sends the payload to the target server. The toolkit can detect the target OS (Windows or Linux) and adjust the payload accordingly. The exploit allows arbitrary command execution on the vulnerable JBoss server. The codebase also includes a full copy of Apache Commons Collections source code, which is used to build the gadget chain for the exploit. The main fingerprintable endpoint is /invoker/readonly, which is targeted by the exploit. The repository is operational and provides a working exploit with customizable payloads for remote code execution.
This repository contains a Python exploit script (CVE-2017-12149.py) targeting the JBoss server vulnerability CVE-2017-12149. The exploit works by sending a specially crafted serialized Java object to the /invoker/readonly endpoint of a target JBoss server over HTTP. The script first attempts to determine the target OS (Linux or Windows) by sending test payloads and analyzing the response. Once the OS is identified, the user can interactively send arbitrary system commands to be executed on the target server, with the output returned to the attacker. The exploit is operational and provides a basic interactive shell-like interface. The README provides minimal usage instructions and notes that the exploit does not work over HTTPS. The main fingerprintable endpoint is /invoker/readonly, which is specific to vulnerable JBoss installations.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A JBoss vulnerability included as one of the exploit modules supported by the attackers' framework.
A JBoss remote code execution vulnerability explicitly listed as used by Sysrv.
A JBoss vulnerability used by newer Satan ransomware versions to spread laterally across local networks.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.