CVE-2015-2342
published 2015-10-12CVE-2015-2342: The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which…
PriorityP277critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
89.05%
99.8th percentile
The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | vcenter_server | — | — |
| vmware | vcenter_server | — | — |
| vmware | vcenter_server | — | — |
| vmware | vcenter_server | — | — |
| vmware | vmware_esxi | — | — |
| vmware | vmware_vcenter_server | — | — |
| vmware | vsphere | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect unauthenticated JMX RMI connections on port 1617 (default Metasploit exploit target port) or port 9875 (vCenter JMX RMI service port); unexpected inbound connections to these ports from external hosts are highly suspicious. ↗
- →Alert on JMX RMI service exposure on port 9875; vCSA blocks this by default, so any external access to this port on Windows vCenter installations is a strong indicator of exploitation attempt. ↗
- →Detect MLet MBean creation and getMBeansFromURL invocation over RMI; these are the core exploit primitives used to load a remote payload JAR from an attacker-controlled HTTP server. ↗
- →Monitor for HTTP requests serving a .jar file and an 'mlet' endpoint from the same host during an active RMI session; this pattern matches the exploit's payload delivery mechanism. ↗
- →Look for RMI traffic initiating a handshake followed by createMBean for 'javax.management.loading.MLet' and subsequent invocation of 'run' on a JMXPayload object; this sequence is the full exploit chain. ↗
- →Use the Metasploit auxiliary scanner module for Java JMX to identify exposed and vulnerable JMX endpoints in the environment. ↗
- ·The fix for CVE-2015-2342 in vCenter Server 5.0 U3e, 5.1 U3b, and 5.5 U3/U3a/U3b running on Windows was incomplete; an additional patch must be applied separately. ↗
- ·JMX interfaces with authentication disabled (com.sun.management.jmxremote.authenticate=false) are directly vulnerable; authentication-enabled interfaces are also exploitable if MLet or ClassLoader MBeans are permitted. ↗
- ·vCSA 5.1, 5.5, and 6.0 block remote access to port 9875 by default, reducing exposure; Windows-based vCenter installations do not have this protection and are at higher risk. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware vCenter and ESXi updates address critical security issues.
vendor_vmware·2015-10-01·CVSS 7.5
CVE-2015-1047 [HIGH] VMware vCenter and ESXi updates address critical security issues.
VMSA-2015-0007: VMware vCenter and ESXi updates address critical security issues.
a. VMware ESXi OpenSLP Remote Code Execution VMware ESXi contains a double free flaw in OpenSLP's SLPDProcessMessage() function. Exploitation of this issue may allow an unauthenticated attacker to remotely execute code on the ESXi host. VMware would like to thank Qinghao Tang of QIHU 360 for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2015-5177 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product ===== Product Version ===== Running on ====== Replace with/ Apply Patch ================== VMware Product =====ESXi Product V
GHSA
GHSA-w37r-rg6f-g7rh: The JMX RMI service in VMware vCenter Server 5
ghsa_unreviewed·2022-05-14
CVE-2015-2342 [HIGH] GHSA-w37r-rg6f-g7rh: The JMX RMI service in VMware vCenter Server 5
The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.
No detection rules found.
Exploit-DB
Java JMX - Server Insecure Configuration Java Code Execution (Metasploit)
exploitdb·2015-02-17
CVE-2015-2342 Java JMX - Server Insecure Configuration Java Code Execution (Metasploit)
Java JMX - Server Insecure Configuration Java Code Execution (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'Java JMX Server Insecure Configuration Java Code Execution',
'Description' => %q{
This module takes advantage a Java JMX interface insecure configuration, which would
allow loading classes from any remote (HTTP) URL. JMX interfaces with authentication
disabled (com.sun.management.jmxremote.authenticate=false) should be vulnerable, while
interfaces with authentication enabled will be vulnerable only if a weak configuration
is deployed (allowing to use javax.management.loading.MLet, having a security manager
allowing to load a ClassLoader
Metasploit
Java JMX Server Insecure Configuration Java Code Execution
metasploit
Java JMX Server Insecure Configuration Java Code Execution
Java JMX Server Insecure Configuration Java Code Execution
This module takes advantage a Java JMX interface insecure configuration, which would allow loading classes from any remote (HTTP) URL. JMX interfaces with authentication disabled (com.sun.management.jmxremote.authenticate=false) should be vulnerable, while interfaces with authentication enabled will be vulnerable only if a weak configuration is deployed (allowing to use javax.management.loading.MLet, having a security manager allowing to load a ClassLoader MBean, etc.).
Metasploit
Java JMX Server Insecure Endpoint Code Execution Scanner
metasploit
Java JMX Server Insecure Endpoint Code Execution Scanner
Java JMX Server Insecure Endpoint Code Execution Scanner
Detect Java JMX endpoints
http://seclists.org/fulldisclosure/2015/Oct/1http://www.securityfocus.com/bid/76930http://www.securitytracker.com/id/1033720http://www.vmware.com/security/advisories/VMSA-2015-0007.htmlhttp://www.zerodayinitiative.com/advisories/ZDI-15-455https://www.7elements.co.uk/resources/technical-advisories/cve-2015-2342-vmware-vcenter-remote-code-execution/http://seclists.org/fulldisclosure/2015/Oct/1http://www.securityfocus.com/bid/76930http://www.securitytracker.com/id/1033720http://www.vmware.com/security/advisories/VMSA-2015-0007.htmlhttp://www.zerodayinitiative.com/advisories/ZDI-15-455https://www.7elements.co.uk/resources/technical-advisories/cve-2015-2342-vmware-vcenter-remote-code-execution/
2015-10-12
Published