WildFly vulnerabilities

WildFly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker with access to the IIOP port may construct and send malicious objects to achieve deserialization, if the target EJB allows untyped method parameters and depending on available gadget chains in the classpath.

A flaw was found in WildFly allowing a remote attacker to bypass authentication on IIOP EJB invocations. The CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, letting a pre-auth attacker on port 3528 impersonate any principal on every IIOP-exposed @Remote EJB.

A flaw was found in WildFly. A user with the Monitor role, the lowest standard RBAC role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an arbitrary location, allowing the Monitor role to read back the server configuration, including sensitive credentials, leading to information disclosure.

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

A path traversal flaw in WildFly's domain mode implementation allows a remote attacker who has obtained the slave host controller secret or compromised a slave host controller to supply a crafted relative path containing directory traversal sequences, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information.

A flaw in the Wildfly Server Role Based Access Control (RBAC) provider allows a user without the required privileges to suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks.

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups "SuperUser", "Admin", or "Maintainer".

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.