CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution

Exploited in the wild Critical 9.8 Published 4 Oct 2017 Updated 7 Oct 2026

Attackers can execute arbitrary code on JBoss Application Server by sending crafted serialized data to the HTTP Invoker.

Exploited in the wild: Since 10 Dec 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-12149?

CVE-2017-12149 is a critical unsafe deserialization vulnerability in Redhat Jboss Enterprise Application Platform, published on 4 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Weakness: CWE-502

Which versions are affected by CVE-2017-12149?

It affects 1 product.

Linux distribution packages (8)

`jbossas` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:5.2.0-24.ep5.el5`
`jbossas-client` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:5.2.0-24.ep5.el5`
`jbossas-messaging` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:5.2.0-24.ep5.el5`
`jbossas-ws-native` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:5.2.0-24.ep5.el5`
`jbossas` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:5.2.0-24.ep5.el6`
`jbossas-client` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:5.2.0-24.ep5.el6`
`jbossas-messaging` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:5.2.0-24.ep5.el6`
`jbossas-ws-native` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:5.2.0-24.ep5.el6`

Products include Redhat Jboss Enterprise Application Platform.

How do I fix CVE-2017-12149?

Apply the vendor's patch. US federal agencies must fix it by 10 Jun 2022.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2017-12149 being exploited?

Yes. Attackers have exploited CVE-2017-12149 in the wild since at least 10 Dec 2021, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 11 proofs of concept on GitHub.

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

Also known as GHSA-j5r3-wq62-8gp5, RHSA-2018:1607.