module

Zend Server Java Bridge Arbitrary Java Code Execution

Disclosed	Created
Mar 28, 2011	May 30, 2018

Disclosed

Mar 28, 2011

Created

May 30, 2018

Description

This module takes advantage of a trust relationship issue within the
Zend Server Java Bridge. The Java Bridge is responsible for handling interactions
between PHP and Java code within Zend Server.

When Java code is encountered Zend Server communicates with the Java Bridge. The
Java Bridge then handles the java code and creates the objects within the Java Virtual
Machine. This interaction however, does not require any sort of authentication. This
leaves the JVM wide open to remote attackers. Sending specially crafted data to the
Java Bridge results in the execution of arbitrary java code.

Author

bannedit [email protected]

Platform

Java

Architectures

java

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/multi/misc/zend_java_bridge
    msf exploit(zend_java_bridge) > show targets
        ...targets...
    msf exploit(zend_java_bridge) > set TARGET < target-id >
    msf exploit(zend_java_bridge) > show options
        ...show and set options...
    msf exploit(zend_java_bridge) > exploit

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report