CVE-2015-3292

published 2015-05-31

CVE-2015-3292: The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) service, which allows…

Priority P2 65 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
netapp	oncommand_workflow_automation	<= 2.2.1	—
netapp	oncommand_workflow_automation	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 8000↗

• → JDWP handshake string is sent as the first bytes of a connection to identify/exploit exposed Java Debug Wire Protocol services — detect this handshake on port 8000 (or any JDWP port) as an indicator of exploitation attempts. ↗
• → Exploitation abuses JDWP protocol features with no authentication required; any inbound connection to a JDWP-listening port (default 8000) that completes the handshake should be treated as suspicious, especially from external/untrusted hosts. ↗
• → The exploit uses java.lang.Runtime.exec to execute system commands on the target VM; monitor for Runtime.exec invocations originating from JDWP-related threads in Java process logs. ↗
• → The exploit writes a payload file to a temporary directory on the target; monitor for unexpected file creation in temp directories by the Java process (NetApp OnCommand Workflow Automation). ↗
• → The exploit uses Base64-encoded payload delivery via java.util.Base64 or sun.misc.BASE64Decoder; monitor for large Base64 string allocations or decodeBuffer/decode invocations over JDWP sessions. ↗

• · The default JDWP port targeted by the Metasploit module is 8000, but JDWP can be configured to listen on other ports; detection rules should not be limited to port 8000 alone. ↗
• · Affected versions are NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1; patched versions should not expose JDWP externally. ↗
• · The exploit supports both Linux x86 and Windows x86 native payloads; detection and remediation should cover both platforms. ↗
• · The TMP_PATH option allows the attacker to specify a custom directory for payload staging; file-write monitoring should not be limited to default temp paths. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-17