Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We just had a breach of one of our servers, where an intruder got access using the JBoss account and started running exploit scripts. The server has been taken offline and is being investigated, but I'm curious about how he got in.

Are there any know vulnerabilities in JBoss 4.x.x that would allow an intruder to run a shell script through that account?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

There is this JBoss Application Server Remote Exploit (CVE-2010-0738) that was published recently.
The exploit works for JBoss running on both Linux and Windows platforms, when the exploit is successful it will return a command prompt or a shell to the attacker.

share|improve this answer

In addition to the vulnerability that Mark mentioned there's also some tools which are freely available which are designed to make taking over JBOSS servers easier, such as jboss-autopwn. If they successfully exploit the server they can deliver Metasploit payloads which includes the ability to get shell.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.