Actively exploited · Published Oct 4, 2017 · Assigned by redhat

CVE-2017-12149

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity unsafe deserialization in jbossas from Red Hat, Inc.. Attackers are actively exploiting it in the wild (listed by CISA on December 10, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 90.7% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)90.7%top 0.2% of all CVEs

Exploited in the wildYesCISA KEV since Dec 10, 2021

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 10, 2022.

Official description

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Affected products (as reported)

Vendor	Product	Versions
Red Hat, Inc.	jbossas	n/a

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://bugzilla.redhat.com/show_bug.cgi?id=1486220 x_refsource_CONFIRM
RHSA-2018:1608 vendor-advisory, x_refsource_REDHAT
https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149 x_refsource_MISC
100591 vdb-entry, x_refsource_BID
RHSA-2018:1607 vendor-advisory, x_refsource_REDHAT
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149 government-resource