CVE-2017-12149: Red Hat JBoss Application Server Remote Code Execution Vulnerability

Vulnerability summary

CVE-2017-12149 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in Red Hat JBoss Application Server. It is known to be exploited: CISA and ENISA list it, first on 10-12-2021. It has been used in ransomware campaigns. EPSS estimates a 90.71% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 04-10-2017
   PublishedVulnerability first disclosed.
2. 10-12-2021
   Added to CISA KEVRed Hat JBoss Application Server Remote Code Execution Vulnerability
3. 10-06-2022
   CISA remediation dueApply updates per vendor instructions.
4. 14-07-2025
   Added to ENISA KEVAdded to the ENISA known exploited vulnerabilities catalog.
5. 07-10-2026
   Last modifiedVulnerability information updated.

Description

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.