CVE-2012-0874 in JBoss Enterprise
Summary
by MITRE
The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) 5.2.0, Web Platform (EWP) 5.2.0, and BRMS Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/21/2025
The vulnerability identified as CVE-2012-0874 represents a critical authentication bypass flaw in JBoss Enterprise Application Platform and related platforms. This security weakness affects JBoss EAP 5.2.0, EWP 5.2.0, and BRMS Platform versions prior to 5.3.1, where the JMXInvokerHAServlet and EJBInvokerHAServlet components fail to enforce authentication by default in specific configuration profiles. The flaw resides in the default security configuration of these invoker servlets, which are designed to facilitate remote management and invocation of enterprise java beans through the JMX and EJB protocols. The vulnerability operates at the application layer and can be classified under CWE-287, which deals with improper authentication mechanisms, and aligns with ATT&CK technique T1190 for exploiting vulnerabilities in remote services.
The technical implementation of this vulnerability stems from the default configuration of the JBoss AS security framework where the invoker servlets are enabled without requiring proper authentication credentials. When these servlets are deployed in certain profiles, they accept remote requests without validating user credentials or session tokens, creating an attack surface that allows malicious actors to directly invoke Management Bean methods through HTTP requests. The attack vector typically involves sending specially crafted HTTP requests to the vulnerable servlet endpoints, which can then be used to execute arbitrary code on the target server with the privileges of the application server process. This represents a severe privilege escalation vulnerability that can lead to complete system compromise.
The operational impact of this vulnerability is substantial as it allows remote attackers to perform unauthorized operations on enterprise applications without requiring valid credentials. Attackers can leverage this flaw to execute arbitrary code, access sensitive data, modify application behavior, and potentially establish persistent access to the target environment. The vulnerability is particularly dangerous because it can be exploited from external networks without requiring prior access to the system, making it an attractive target for automated attacks. The risk is amplified when considering that the vulnerability only requires a "second layer of authentication" to be properly configured, which many organizations fail to implement correctly. This issue can be categorized under ATT&CK tactic T1078 for valid accounts and T1068 for exploit for privilege escalation, as it allows unauthorized access to system resources through legitimate application interfaces.
Organizations affected by CVE-2012-0874 should implement immediate mitigations including disabling the vulnerable invoker servlets when not required, enforcing proper authentication mechanisms through configuration changes, and applying the vendor-provided patches available for JBoss EAP 5.2.0 and BRMS Platform 5.3.1. The recommended approach involves configuring the security interceptors to enforce proper authentication before allowing access to the JMX and EJB invoker endpoints. Additionally, network segmentation and firewall rules should be implemented to restrict access to these vulnerable servlets from untrusted networks. Security monitoring should be enhanced to detect suspicious access patterns to these endpoints, and regular security audits should verify that the second layer of authentication is properly configured. The vulnerability also highlights the importance of following security best practices such as the principle of least privilege and defense in depth, which are core concepts in both NIST cybersecurity frameworks and ISO/IEC 27001 standards.