Java EJBInvokerServlet / JMXInvokerServlet
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/23422079/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
EJBInvokerServlet / JMXInvokerServlet
提问by Sam
thanks to anyone reading this post.
感谢任何阅读这篇文章的人。
A penetration test was performed by an external agency on my Staging server application which is on JBoss 4.0.4 instance.
渗透测试由外部机构在我的 JBoss 4.0.4 实例上的 Staging 服务器应用程序上执行。
It was reported for ‘Apache Tomcat / JBoss EJBInvokerServlet / JMXInvokerServlet Marshalled Object Remote Code Execution'
报告“Apache Tomcat / JBoss EJBInvokerServlet / JMXInvokerServlet Marshalled Object Remote Code Execution”
It is suggested to upgrade the JBoss server to close the vulnerability. Because of different business reasons I cannot upgrade to latest versions for the next 1 year or so.
建议升级JBoss服务器关闭漏洞。由于不同的业务原因，我无法在接下来的 1 年左右升级到最新版本。
In my application we don't need to use any war deployment through any of these Servlets. I made some changes to work around [work around for the next 1 year]. What is the best way to test whether the environment is still vulnerable to this reported case? – Don't have option to get the service from the external agency again.
在我的应用程序中，我们不需要通过任何这些 Servlet 使用任何War部署。我做了一些改变来解决[在接下来的 1 年中解决]。测试环境是否仍然容易受到此报告案例的影响的最佳方法是什么？– 无法再次从外部机构获取服务。
By the way after my changes, for the urls http:///invoker/EJBInvokerServlet and http:///invoker/JMXInvokerServlet I can see the page with message ‘The requested resource (/invoker/JMXInvokerServlet) is not available.' Before the changes these urls were opening EJBInvokerServlet and JMXInvokerServlet
顺便说一下，在我更改之后，对于 URL http:///invoker/EJBInvokerServlet 和 http:///invoker/JMXInvokerServlet，我可以看到带有消息“请求的资源 (/invoker/JMXInvokerServlet) 不可用”的页面。在更改这些 url 之前打开 EJBInvokerServlet 和 JMXInvokerServlet
Can someone please suggest the way to validate whether the environment is still vulnerable?
有人可以建议验证环境是否仍然脆弱的方法吗？
Also let me know if there is any recommended solution is available fix the vulnerability in JBoss 4.0.4.
另外让我知道是否有任何推荐的解决方案可以修复 JBoss 4.0.4 中的漏洞。
Thank you.
谢谢你。
采纳答案by juanchi
It seems you are refering to CVE-2012-0874:
您似乎指的是 CVE-2012-0874：
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0874
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0874
An exploit for this vulnerability may be found at:
可以在以下位置找到此漏洞的利用：
http://www.securityfocus.com/bid/62854
http://www.securityfocus.com/bid/62854
Look under the "exploit" tab on that page. The PHP code attempts an HTTP POST request to deploy an abritrary war file.
查看该页面上的“利用”选项卡。PHP 代码尝试 HTTP POST 请求来部署 abritrary War文件。
You said you can no longer access the /invoker/EJBInvokerServlet and /invoker/JMXInvokerServlet resources, so you are safe.
你说你不能再访问 /invoker/EJBInvokerServlet 和 /invoker/JMXInvokerServlet 资源，所以你是安全的。
回答by Steve C
Have you also disabled or secured the JMX Console?
您是否也禁用或保护了 JMX 控制台？
If you have secured it by commenting out the security constraints in it's web.xml make sure that you remove all the http-method elements otherwise attackers can use the HEAD method to gain unsecured access.
如果您通过注释掉 web.xml 中的安全约束来保护它，请确保删除所有 http-method 元素，否则攻击者可以使用 HEAD 方法获得不安全的访问。
The recommended solution to fix all vulnerabilities is to upgrade.
修复所有漏洞的推荐解决方案是升级。
