module

Java JMX Server Insecure Configuration Java Code Execution

Try Surface Command
Back to search
Disclosed
2013-05-22
Created
2018-05-30

Description

This module takes advantage a Java JMX interface insecure configuration, which would
allow loading classes from any remote (HTTP) URL. JMX interfaces with authentication
disabled (com.sun.management.jmxremote.authenticate=false) should be vulnerable, while
interfaces with authentication enabled will be vulnerable only if a weak configuration
is deployed (allowing to use javax.management.loading.MLet, having a security manager
allowing to load a ClassLoader MBean, etc.).

Authors

Braden Thomas
juan vazquez juan.vazquez@metasploit.com

Platform

Java

Architectures

java

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/multi/misc/java_jmx_server
    msf exploit(java_jmx_server) > show targets
        ...targets...
    msf exploit(java_jmx_server) > set TARGET < target-id >
    msf exploit(java_jmx_server) > show options
        ...show and set options...
    msf exploit(java_jmx_server) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today