CVE-2010-1871
HIGH KEVJBoss Enterprise Application Platform 4.3.0 - Remote Code Execution via JBoss Expression Language Injection
Title source: llmExploitation Summary
CVE-2010-1871 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 10, 2021.
EIP tracks 3 public exploits from researchers including Metasploit, guerrino di massa, including a Metasploit module auxiliary/admin/http/jboss_seam_exec.
AI-analyzed exploit summary This Metasploit module exploits CVE-2010-1871, a JBoss Seam 2 vulnerability allowing unauthenticated remote code execution via unsanitized JBoss Expression Language inputs. It uploads a malicious JSP and JAR payload to achieve a Meterpreter shell.
Description
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
Exploits (3)
This Metasploit module exploits CVE-2010-1871, a JBoss Seam 2 vulnerability allowing unauthenticated remote code execution via unsanitized JBoss Expression Language inputs. It uploads a malicious JSP and JAR payload to achieve a Meterpreter shell.
This Metasploit module exploits a remote command execution vulnerability in JBoss Seam 2 by leveraging unsanitized JBoss Expression Language (EL) inputs. It dynamically identifies method indices for 'Runtime.exec' and 'Runtime.getRuntime' to execute arbitrary commands via a crafted URL.
This Metasploit module exploits a JBoss Seam 2 vulnerability (CVE-2010-1871) to achieve remote code execution by uploading and executing a malicious JSP file. It leverages improper input sanitization in JBoss Expression Language to execute arbitrary commands.
References (9)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H