Server-Side Request Forgery (SSRF) in JBoss Enterprise Application Platform - CVE-2024-1233

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU92251

Server-Side Request Forgery (SSRF) in JBoss Enterprise Application Platform - CVE-2024-1233

Published: June 19, 2024


Vulnerability identifier: #VU92251
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2024-1233
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the JwtValidator.resolvePublicKey. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.


Affected software

JBoss Enterprise Application Platform
eap7-jboss-jsf (Red Hat package)
eap8-jose4j (Red Hat package)
eap8-guava-failureaccess (Red Hat package)
eap8-amazon-ion-java (Red Hat package)
eap8-reactive-streams (Red Hat package)
eap8-fge-msg-simple (Red Hat package)
eap8-insights-java-client (Red Hat package)
eap8-jboss-cert-helper (Red Hat package)
eap8-log4j2-jboss-logmanager (Red Hat package)
eap8-jakarta-json (Red Hat package)
eap7-wildfly-http-client (Red Hat package)
eap7-wildfly-transaction-client (Red Hat package)
eap8-fge-btf (Red Hat package)
eap7-wildfly-discovery (Red Hat package)
eap8-java-classmate (Red Hat package)
eap8-wsdl4j (Red Hat package)
eap8-jasypt (Red Hat package)
eap8-apache-commons-beanutils (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-jboss-modules (Red Hat package)
eap8-apache-commons-codec (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap8-snakeyaml (Red Hat package)
eap8-angus-activation (Red Hat package)
eap8-atinject (Red Hat package)
eap8-jakarta-transaction-api (Red Hat package)
eap8-jgroups-kubernetes (Red Hat package)
eap8-angus (Red Hat package)
eap8-wildfly-http-client (Red Hat package)
eap8-slf4j (Red Hat package)
eap8-jakarta-interceptor-api (Red Hat package)
eap8-jakarta-batch-api (Red Hat package)
eap8-jakarta-annotation-api (Red Hat package)
eap8-jakarta-mail (Red Hat package)
eap8-jakarta-activation (Red Hat package)
eap8-jakarta-json-api (Red Hat package)
eap8-jberet (Red Hat package)
eap8-jboss-modules (Red Hat package)
eap8-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap8-ws-commons-XmlSchema (Red Hat package)
eap8-velocity (Red Hat package)
eap7-xml-security (Red Hat package)
eap7-wss4j (Red Hat package)
eap8-gson (Red Hat package)
eap8-apache-commons-io (Red Hat package)
eap8-apache-sshd (Red Hat package)
eap8-joda-time (Red Hat package)
eap8-jackson-dataformats-binary (Red Hat package)
eap8-jackson-modules-java8 (Red Hat package)
eap8-jackson-modules-base (Red Hat package)
eap8-jackson-jaxrs-providers (Red Hat package)
eap8-jackson-databind (Red Hat package)
eap8-jackson-core (Red Hat package)
eap8-jackson-annotations (Red Hat package)
eap8-activemq-artemis (Red Hat package)
eap8-wss4j (Red Hat package)
eap8-jakarta-validation-api (Red Hat package)
eap8-yasson (Red Hat package)
eap8-wildfly-transaction-client (Red Hat package)
eap8-ironjacamar (Red Hat package)
eap8-javaee-jpa-spec (Red Hat package)
eap8-jakarta-ws-rs-api (Red Hat package)
eap8-jakarta-jms-api (Red Hat package)
eap8-caffeine (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap8-hal-console (Red Hat package)
eap8-apache-cxf (Red Hat package)
eap8-jakarta-xml-bind-api (Red Hat package)
eap8-elytron-web (Red Hat package)
eap8-jaxb (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap8-sun-istack-commons (Red Hat package)
eap8-httpcomponents-asyncclient (Red Hat package)
eap8-netty (Red Hat package)
eap8-netty-transport-native-epoll (Red Hat package)
eap8-stax2-api (Red Hat package)
eap8-httpcomponents-core (Red Hat package)
eap8-httpcomponents-client (Red Hat package)
eap8-protostream (Red Hat package)
eap8-antlr4 (Red Hat package)
eap8-jboss-ejb-client (Red Hat package)
eap8-jgroups (Red Hat package)
eap8-jakarta-servlet-api (Red Hat package)
eap8-narayana (Red Hat package)
eap8-hibernate-search (Red Hat package)
eap8-resteasy (Red Hat package)
eap8-hibernate (Red Hat package)
eap8-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
eap8-hibernate-validator (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-lucene-solr (Red Hat package)
eap7-infinispan (Red Hat package)
eap7-jboss-metadata (Red Hat package)
eap8-infinispan (Red Hat package)
eap8-guava-libraries (Red Hat package)

How to mitigate CVE-2024-1233

Install updates from vendor's website.

JBoss Enterprise Application Platform - addressed in versions 7.4.17, 8.0.2
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el9eap
eap8-jose4j (Red Hat package) - addressed in versions 0.9.3-2.redhat_00004.1.el8eap, 0.9.3-2.redhat_00004.1.el9eap
eap8-guava-failureaccess (Red Hat package) - addressed in versions 1.0.1-4.redhat_00012.1.el8eap, 1.0.1-4.redhat_00012.1.el9eap
eap8-amazon-ion-java (Red Hat package) - addressed in versions 1.0.2-4.redhat_00005.1.el8eap, 1.0.2-4.redhat_00005.1.el9eap
eap8-reactive-streams (Red Hat package) - addressed in versions 1.0.4-2.redhat_00003.1.el8eap, 1.0.4-2.redhat_00003.1.el9eap
eap8-fge-msg-simple (Red Hat package) - addressed in versions 1.1.0-2.redhat_00015.1.el8eap, 1.1.0-2.redhat_00015.1.el9eap
eap8-insights-java-client (Red Hat package) - addressed in versions 1.1.2-1.redhat_00001.1.el8eap, 1.1.2-1.redhat_00001.1.el9eap
eap8-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.2-1.redhat_00001.1.el8eap, 1.1.2-1.redhat_00001.1.el9eap
eap8-log4j2-jboss-logmanager (Red Hat package) - addressed in versions 1.1.2-1.Final_redhat_00002.1.el8eap, 1.1.2-1.Final_redhat_00002.1.el9eap
eap8-jakarta-json (Red Hat package) - addressed in versions 1.1.6-4.redhat_00003.1.el8eap, 1.1.6-4.redhat_00003.1.el9eap
eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.17-1.Final_redhat_00002.1.el7eap, 1.1.17-1.Final_redhat_00002.1.el8eap, 1.1.17-1.Final_redhat_00002.1.el9eap
eap7-wildfly-transaction-client (Red Hat package) - addressed in versions 1.1.19-1.Final_redhat_00001.1.el7eap, 1.1.19-1.Final_redhat_00001.1.el8eap, 1.1.19-1.Final_redhat_00001.1.el9eap
eap8-fge-btf (Red Hat package) - addressed in versions 1.2.0-2.redhat_00017.1.el8eap, 1.2.0-2.redhat_00017.1.el9eap
eap7-wildfly-discovery (Red Hat package) - addressed in versions 1.2.4-1.Final_redhat_00001.1.el7eap, 1.2.4-1.Final_redhat_00001.1.el8eap, 1.2.4-1.Final_redhat_00001.1.el9eap
eap8-java-classmate (Red Hat package) - addressed in versions 1.5.1-2.redhat_00003.1.el8eap, 1.5.1-2.redhat_00003.1.el9eap
eap8-wsdl4j (Red Hat package) - addressed in versions 1.6.3-4.redhat_00007.1.el8eap, 1.6.3-4.redhat_00007.1.el9eap
eap8-jasypt (Red Hat package) - addressed in versions 1.9.3-3.redhat_00003.1.el8eap, 1.9.3-3.redhat_00003.1.el9eap
eap8-apache-commons-beanutils (Red Hat package) - addressed in versions 1.9.4-12.redhat_00003.1.el8eap, 1.9.4-12.redhat_00003.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-36.Final_redhat_00035.1.el7eap, 1.10.0-36.Final_redhat_00035.1.el8eap, 1.10.0-36.Final_redhat_00035.1.el9eap
eap7-jboss-modules (Red Hat package) - addressed in versions 1.12.3-3.Final_redhat_00001.1.el7eap, 1.12.3-3.Final_redhat_00001.1.el8eap, 1.12.3-3.Final_redhat_00001.1.el9eap
eap8-apache-commons-codec (Red Hat package) - addressed in versions 1.15.0-5.redhat_00015.1.el8eap, 1.15.0-5.redhat_00015.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.23-2.Final_redhat_00001.1.el7eap, 1.15.23-2.Final_redhat_00001.1.el8eap, 1.15.23-2.Final_redhat_00001.1.el9eap
eap8-snakeyaml (Red Hat package) - addressed in versions 2.0.0-2.redhat_00012.1.el8eap, 2.0.0-2.redhat_00012.1.el9eap
eap8-angus-activation (Red Hat package) - addressed in versions 2.0.1-2.redhat_00005.1.el8eap, 2.0.1-2.redhat_00005.1.el9eap
eap8-atinject (Red Hat package) - addressed in versions 2.0.1-2.redhat_00005.1.el8eap, 2.0.1-2.redhat_00005.1.el9eap
eap8-jakarta-transaction-api (Red Hat package) - addressed in versions 2.0.1-3.redhat_00004.1.el8eap, 2.0.1-3.redhat_00004.1.el9eap
eap8-jgroups-kubernetes (Red Hat package) - addressed in versions 2.0.2-1.Final_redhat_00001.1.el8eap, 2.0.2-1.Final_redhat_00001.1.el9eap
eap8-angus (Red Hat package) - addressed in versions 2.0.2-3.redhat_00002.1.el8eap, 2.0.2-3.redhat_00002.1.el9eap
eap8-wildfly-http-client (Red Hat package) - addressed in versions 2.0.7-1.Final_redhat_00001.1.el8eap, 2.0.7-1.Final_redhat_00001.1.el9eap
eap8-slf4j (Red Hat package) - addressed in versions 2.0.7-3.redhat_00003.1.el8eap, 2.0.7-3.redhat_00003.1.el9eap
eap8-jakarta-interceptor-api (Red Hat package) - addressed in versions 2.1.0-4.redhat_00002.1.el8eap, 2.1.0-4.redhat_00002.1.el9eap
eap8-jakarta-batch-api (Red Hat package) - addressed in versions 2.1.1-3.redhat_00003.1.el8eap, 2.1.1-3.redhat_00003.1.el9eap
eap8-jakarta-annotation-api (Red Hat package) - addressed in versions 2.1.1-4.redhat_00003.1.el8eap, 2.1.1-4.redhat_00003.1.el9eap
eap8-jakarta-mail (Red Hat package) - addressed in versions 2.1.2-2.redhat_00003.1.el8eap, 2.1.2-2.redhat_00003.1.el9eap
eap8-jakarta-activation (Red Hat package) - addressed in versions 2.1.2-2.redhat_00005.1.el8eap, 2.1.2-2.redhat_00005.1.el9eap
eap8-jakarta-json-api (Red Hat package) - addressed in versions 2.1.2-3.redhat_00003.1.el8eap, 2.1.2-3.redhat_00003.1.el9eap
eap8-jberet (Red Hat package) - addressed in versions 2.1.4-1.Final_redhat_00001.1.el8eap, 2.1.4-1.Final_redhat_00001.1.el9eap
eap8-jboss-modules (Red Hat package) - addressed in versions 2.1.4-2.Final_redhat_00001.1.el8eap, 2.1.4-2.Final_redhat_00001.1.el9eap
eap8-wildfly-elytron (Red Hat package) - addressed in versions 2.2.4-2.SP01_redhat_00001.1.el8eap, 2.2.4-2.SP01_redhat_00001.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.32-1.SP1_redhat_00001.1.el7eap, 2.2.32-1.SP1_redhat_00001.1.el8eap, 2.2.32-1.SP1_redhat_00001.1.el9eap
eap8-ws-commons-XmlSchema (Red Hat package) - addressed in versions 2.3.0-2.redhat_00002.1.el8eap, 2.3.0-2.redhat_00002.1.el9eap
eap8-velocity (Red Hat package) - addressed in versions 2.3.0-2.redhat_00008.1.el8eap, 2.3.0-2.redhat_00008.1.el9eap
eap7-xml-security (Red Hat package) - addressed in versions 2.3.4-1.redhat_00002.1.el7eap, 2.3.4-1.redhat_00002.1.el8eap, 2.3.4-1.redhat_00002.1.el9eap
eap7-wss4j (Red Hat package) - addressed in versions 2.4.3-1.redhat_00001.1.el7eap, 2.4.3-1.redhat_00001.1.el8eap, 2.4.3-1.redhat_00001.1.el9eap
eap8-gson (Red Hat package) - addressed in versions 2.8.9-2.redhat_00002.1.el8eap, 2.8.9-2.redhat_00002.1.el9eap
eap8-apache-commons-io (Red Hat package) - addressed in versions 2.11.0-2.redhat_00003.1.el8eap, 2.11.0-2.redhat_00003.1.el9eap
eap8-apache-sshd (Red Hat package) - addressed in versions 2.12.1-1.redhat_00001.1.el8eap, 2.12.1-1.redhat_00001.1.el9eap
eap8-joda-time (Red Hat package) - addressed in versions 2.12.5-1.redhat_00001.1.el8eap, 2.12.5-1.redhat_00001.1.el9eap
eap8-jackson-dataformats-binary (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-modules-java8 (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-modules-base (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-databind (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-core (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-annotations (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-activemq-artemis (Red Hat package) - addressed in versions 2.21.0-4.redhat_00048.1.el8eap, 2.21.0-4.redhat_00048.1.el9eap
eap8-wss4j (Red Hat package) - addressed in versions 3.0.1-2.redhat_00014.1.el8eap, 3.0.1-2.redhat_00014.1.el9eap
eap8-jakarta-validation-api (Red Hat package) - addressed in versions 3.0.2-2.redhat_00005.1.el8eap, 3.0.2-2.redhat_00005.1.el9eap
eap8-yasson (Red Hat package) - addressed in versions 3.0.3-2.redhat_00001.1.el8eap, 3.0.3-2.redhat_00001.1.el9eap
eap8-wildfly-transaction-client (Red Hat package) - addressed in versions 3.0.5-1.Final_redhat_00001.1.el8eap, 3.0.5-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar (Red Hat package) - addressed in versions 3.0.8-1.Final_redhat_00001.1.el8eap, 3.0.8-1.Final_redhat_00001.1.el9eap
eap8-javaee-jpa-spec (Red Hat package) - addressed in versions 3.1.0-3.redhat_00002.1.el8eap, 3.1.0-3.redhat_00002.1.el9eap
eap8-jakarta-ws-rs-api (Red Hat package) - addressed in versions 3.1.0-4.redhat_00002.1.el8eap, 3.1.0-4.redhat_00002.1.el9eap
eap8-jakarta-jms-api (Red Hat package) - addressed in versions 3.1.0-4.redhat_00003.1.el8eap, 3.1.0-4.redhat_00003.1.el9eap
eap8-caffeine (Red Hat package) - addressed in versions 3.1.8-1.redhat_00001.1.el8eap, 3.1.8-1.redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.22-1.Final_redhat_00001.1.el7eap, 3.3.22-1.Final_redhat_00001.1.el8eap, 3.3.22-1.Final_redhat_00001.1.el9eap
eap7-apache-cxf (Red Hat package) - addressed in versions 3.5.8-1.redhat_00001.1.el7eap, 3.5.8-1.redhat_00001.1.el8eap, 3.5.8-1.redhat_00001.1.el9eap
eap8-hal-console (Red Hat package) - addressed in versions 3.6.18-1.Final_redhat_00001.1.el8eap, 3.6.18-1.Final_redhat_00001.1.el9eap
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.0-2.redhat_00002.1.el8eap, 4.0.0-2.redhat_00002.1.el9eap
eap8-jakarta-xml-bind-api (Red Hat package) - addressed in versions 4.0.0-4.redhat_00009.1.el8eap, 4.0.0-4.redhat_00009.1.el9eap
eap8-elytron-web (Red Hat package) - addressed in versions 4.0.1-1.Final_redhat_00001.1.el8eap, 4.0.1-1.Final_redhat_00001.1.el9eap
eap8-jaxb (Red Hat package) - addressed in versions 4.0.2-4.redhat_00001.1.el8eap, 4.0.2-4.redhat_00001.1.el9eap
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.54-3.Final_redhat_00001.1.el7eap, 4.0.54-3.Final_redhat_00001.1.el8eap, 4.0.54-3.Final_redhat_00001.1.el9eap
eap8-sun-istack-commons (Red Hat package) - addressed in versions 4.1.2-1.redhat_00003.1.el8eap, 4.1.2-1.redhat_00003.1.el9eap
eap8-httpcomponents-asyncclient (Red Hat package) - addressed in versions 4.1.5-2.redhat_00004.1.el8eap, 4.1.5-2.redhat_00004.1.el9eap
eap8-netty (Red Hat package) - addressed in versions 4.1.100-2.Final_redhat_00001.1.el8eap, 4.1.100-2.Final_redhat_00001.1.el9eap
eap8-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.100-5.Final_redhat_00001.1.el8eap, 4.1.100-5.Final_redhat_00001.1.el9eap
eap8-stax2-api (Red Hat package) - addressed in versions 4.2.1-2.redhat_00008.1.el8eap, 4.2.1-2.redhat_00008.1.el9eap
eap8-httpcomponents-core (Red Hat package) - addressed in versions 4.4.16-2.redhat_00008.1.el8eap, 4.4.16-2.redhat_00008.1.el9eap
eap8-httpcomponents-client (Red Hat package) - addressed in versions 4.5.14-2.redhat_00010.1.el8eap, 4.5.14-2.redhat_00010.1.el9eap
eap8-protostream (Red Hat package) - addressed in versions 4.6.5-4.Final_redhat_00006.1.el8eap, 4.6.5-4.Final_redhat_00006.1.el9eap
eap8-antlr4 (Red Hat package) - addressed in versions 4.10.1-1.redhat_00001.1.el8eap, 4.10.1-1.redhat_00001.1.el9eap
eap8-jboss-ejb-client (Red Hat package) - addressed in versions 5.0.6-1.Final_redhat_00001.1.el8eap, 5.0.6-1.Final_redhat_00001.1.el9eap
eap8-jgroups (Red Hat package) - addressed in versions 5.2.23-1.Final_redhat_00001.1.el8eap, 5.2.23-1.Final_redhat_00001.1.el9eap
eap8-jakarta-servlet-api (Red Hat package) - addressed in versions 6.0.0-4.redhat_00005.1.el8eap, 6.0.0-4.redhat_00005.1.el9eap
eap8-narayana (Red Hat package) - addressed in versions 6.0.2-1.Final_redhat_00002.1.el8eap, 6.0.2-1.Final_redhat_00002.1.el9eap
eap8-hibernate-search (Red Hat package) - addressed in versions 6.2.2-1.Final_redhat_00001.1.el8eap, 6.2.2-1.Final_redhat_00001.1.el9eap
eap8-resteasy (Red Hat package) - addressed in versions 6.2.7-1.Final_redhat_00001.1.el8eap, 6.2.7-1.Final_redhat_00001.1.el9eap
eap8-hibernate (Red Hat package) - addressed in versions 6.2.18-1.Final_redhat_00001.1.el8eap, 6.2.18-1.Final_redhat_00001.1.el9eap
eap8-woodstox-core (Red Hat package) - addressed in versions 6.4.0-2.redhat_00002.1.el8eap, 6.4.0-2.redhat_00002.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.4.17-2.GA_redhat_00002.1.el7eap, 7.4.17-2.GA_redhat_00002.1.el8eap, 7.4.17-2.GA_redhat_00002.1.el9eap
eap8-hibernate-validator (Red Hat package) - addressed in versions 8.0.1-1.Final_redhat_00001.1.el8eap, 8.0.1-1.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.2-2.GA_redhat_00009.1.el8eap, 8.0.2-2.GA_redhat_00009.1.el9eap
eap8-lucene-solr (Red Hat package) - addressed in versions 8.11.3-1.redhat_00001.1.el8eap, 8.11.3-1.redhat_00001.1.el9eap
eap7-infinispan (Red Hat package) - addressed in versions 11.0.19-2.Final_redhat_00001.1.el7eap, 11.0.19-2.Final_redhat_00001.1.el8eap, 11.0.19-2.Final_redhat_00001.1.el9eap
eap7-jboss-metadata (Red Hat package) - addressed in versions 13.5.0-1.Final_redhat_00001.1.el7eap, 13.5.0-1.Final_redhat_00001.1.el8eap, 13.5.0-1.Final_redhat_00001.1.el9eap
eap8-infinispan (Red Hat package) - addressed in versions 14.0.24-1.Final_redhat_00001.1.el8eap, 14.0.24-1.Final_redhat_00001.1.el9eap
eap8-guava-libraries (Red Hat package) - addressed in versions 32.1.2-1.jre_redhat_00001.1.el8eap, 32.1.2-1.jre_redhat_00001.1.el9eap

External References

Related Security Bulletins