title: EJBInvokerServlet / JMXInvokerServlet
body: <p>thanks to anyone reading this post.</p>
  
  <p>A penetration test was performed by an external agency on my Staging server application which is on JBoss 4.0.4 instance.</p>
  
  <p>It was reported for ‘Apache Tomcat / JBoss EJBInvokerServlet / JMXInvokerServlet Marshalled Object Remote Code Execution’</p>
  
  <p>It is suggested to upgrade the JBoss server to close the vulnerability. Because of different business reasons I cannot upgrade to latest versions for the next 1 year or so.</p>
  
  <p>In my application we don’t need to use any war deployment through any of these Servlets. I made some changes to work around [work around for the next 1 year]. What is the best way to test whether the environment is still vulnerable to this reported case? – Don’t have option to get the service from the external agency again.</p>
  
  <p>By the way after my changes, for the urls http:///invoker/EJBInvokerServlet and http:///invoker/JMXInvokerServlet I can see the page with message ‘The requested resource (/invoker/JMXInvokerServlet) is not available.’ Before the changes these urls were opening EJBInvokerServlet and JMXInvokerServlet</p>
  
  <p>Can someone please suggest the way to validate whether the environment is still vulnerable?</p>
  
  <p>Also let me know if there is any recommended solution is available fix the vulnerability in JBoss 4.0.4.</p>
  
  <p>Thank you.</p>