{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10352","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10352/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10352/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10352/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/10352","id":343070627,"node_id":"MDExOlB1bGxSZXF1ZXN0MjAyODIwNDY5","number":10352,"title":"Added check and response for CVE-2017-12149 in jboss_vulnscan.rb","user":{"login":"timoles","id":18122064,"node_id":"MDQ6VXNlcjE4MTIyMDY0","avatar_url":"https://avatars2.githubusercontent.com/u/18122064?v=4","gravatar_id":"","url":"https://api.github.com/users/timoles","html_url":"https://github.com/timoles","followers_url":"https://api.github.com/users/timoles/followers","following_url":"https://api.github.com/users/timoles/following{/other_user}","gists_url":"https://api.github.com/users/timoles/gists{/gist_id}","starred_url":"https://api.github.com/users/timoles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timoles/subscriptions","organizations_url":"https://api.github.com/users/timoles/orgs","repos_url":"https://api.github.com/users/timoles/repos","events_url":"https://api.github.com/users/timoles/events{/privacy}","received_events_url":"https://api.github.com/users/timoles/received_events","type":"User","site_admin":false},"labels":[{"id":213102939,"node_id":"MDU6TGFiZWwyMTMxMDI5Mzk=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/enhancement","name":"enhancement","color":"5319e7","default":true},{"id":103436014,"node_id":"MDU6TGFiZWwxMDM0MzYwMTQ=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-20T11:20:00Z","updated_at":"2018-07-21T19:47:33Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10352","html_url":"https://github.com/rapid7/metasploit-framework/pull/10352","diff_url":"https://github.com/rapid7/metasploit-framework/pull/10352.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/10352.patch"},"body":"This change adds an additional vulnerability check to auxiliary/scanner/http/jboss_vulnscan\r\nThe addition was a check for CVE-2017-12149, a deserialization RCE vulnerability in Red Hat JBoss EAP 5.\r\n\r\n```\r\nIt was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization. This allows an attacker to execute arbitrary code via crafted serialized data.\r\n```\r\n\r\nChanges made: \r\nAdded the URL to check\r\nprint_good() in case of the URL is accessible \r\n\r\n\r\n## Verification\r\n\r\nList the steps needed to make sure this thing works\r\n\r\n- [ ] Start `msfconsole`\r\n- [ ] `use auxiliary/scanner/http/jboss_vulnscan`\r\n- [ ] set Host of a vulnerable JBoss EAP5 server\r\n- [ ] **Verify* `[+] 192.168.0.244:8080 /invoker/readonly responded (500)` is displayed\r\n- [ ] set Host of a not vulnerable JBoss server version\r\n- [ ] **Verify** `[*] 192.168.0.244:8080 /invoker/readonly not found (404)` is displayed\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/406819557","html_url":"https://github.com/rapid7/metasploit-framework/pull/10352#issuecomment-406819557","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10352","id":406819557,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNjgxOTU1Nw==","user":{"login":"bcoles","id":434827,"node_id":"MDQ6VXNlcjQzNDgyNw==","avatar_url":"https://avatars2.githubusercontent.com/u/434827?v=4","gravatar_id":"","url":"https://api.github.com/users/bcoles","html_url":"https://github.com/bcoles","followers_url":"https://api.github.com/users/bcoles/followers","following_url":"https://api.github.com/users/bcoles/following{/other_user}","gists_url":"https://api.github.com/users/bcoles/gists{/gist_id}","starred_url":"https://api.github.com/users/bcoles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcoles/subscriptions","organizations_url":"https://api.github.com/users/bcoles/orgs","repos_url":"https://api.github.com/users/bcoles/repos","events_url":"https://api.github.com/users/bcoles/events{/privacy}","received_events_url":"https://api.github.com/users/bcoles/received_events","type":"User","site_admin":false},"created_at":"2018-07-21T19:47:33Z","updated_at":"2018-07-21T19:47:33Z","author_association":"CONTRIBUTOR","body":"I know it's an issue with the original module, rather than your update, however, rather than wrapping everything in a conditional like this:\r\n\r\n```ruby\r\n  def check_app(app)\r\n    res = send_request_cgi({\r\n      'uri'       => app,\r\n      'method'    => 'GET',\r\n      'ctype'     => 'text/plain'\r\n    })\r\n\r\n    if res\r\n      case\r\n      when res.code == 200\r\n        print_good(\"#{rhost}:#{rport} #{app} does not require authentication (200)\")\r\n      when res.code == 403\r\n        print_status(\"#{rhost}:#{rport} #{app} restricted (403)\")\r\n      when res.code == 401\r\n        print_status(\"#{rhost}:#{rport} #{app} requires authentication (401): #{res.headers['WWW-Authenticate']}\")\r\n        bypass_auth(app)\r\n        basic_auth_default_creds(app)\r\n      when res.code == 404\r\n        print_status(\"#{rhost}:#{rport} #{app} not found (404)\")\r\n      when res.code == 301, res.code == 302\r\n        print_status(\"#{rhost}:#{rport} #{app} is redirected (#{res.code}) to #{res.headers['Location']} (not following)\")\r\n      else\r\n        if res.code == 500 && app == \"/invoker/readonly\"\r\n          print_good(\"#{rhost}:#{rport} #{app} responded (#{res.code})\")\r\n        end\r\n        print_status(\"#{rhost}:#{rport} Don't know how to handle response code #{res.code}\")\r\n      end\r\n    else\r\n      print_status(\"#{rhost}:#{rport} #{app} not found\")\r\n    end\r\n  end\r\n```\r\n\r\nThis is better:\r\n\r\n```ruby\r\n  def check_app(app)\r\n    res = send_request_cgi({\r\n      'uri'       => app,\r\n      'method'    => 'GET',\r\n      'ctype'     => 'text/plain'\r\n    })\r\n\r\n    unless res\r\n      print_status(\"#{rhost}:#{rport} #{app} not found\")\r\n      return\r\n    end\r\n\r\n    case\r\n    when res.code == 200\r\n      print_good(\"#{rhost}:#{rport} #{app} does not require authentication (200)\")\r\n    when res.code == 403\r\n      print_status(\"#{rhost}:#{rport} #{app} restricted (403)\")\r\n    when res.code == 401\r\n      print_status(\"#{rhost}:#{rport} #{app} requires authentication (401): #{res.headers['WWW-Authenticate']}\")\r\n      bypass_auth(app)\r\n      basic_auth_default_creds(app)\r\n    when res.code == 404\r\n      print_status(\"#{rhost}:#{rport} #{app} not found (404)\")\r\n    when res.code == 301, res.code == 302\r\n      print_status(\"#{rhost}:#{rport} #{app} is redirected (#{res.code}) to #{res.headers['Location']} (not following)\")\r\n    else\r\n      if res.code == 500 && app == \"/invoker/readonly\"\r\n        print_good(\"#{rhost}:#{rport} #{app} responded (#{res.code})\")\r\n      end\r\n      print_status(\"#{rhost}:#{rport} Don't know how to handle response code #{res.code}\")\r\n    end\r\n  end\r\n```"}}
{"actor":{"display_login":"bcoles"}}