CVE-2015-5188

published 2015-10-27

CVE-2015-5188: Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly…

Priority P1 81 medium 6.8 CVSS 2.0

AV N AC M Au N C P I P A P

ITW VulnCheck KEV Ransomware

Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
redhat	jboss_enterprise_application_platform	<= 6.4.3	—
redhat	jboss_wildfly_application_server	<= 2.0.0	—

Detection & IOCs extracted from sources · hover to see the quote

• → The CSRF attack vector specifically targets multipart/form-data file upload submissions to the EAP/WildFly Web Console management interface; monitor for cross-origin multipart/form-data POST requests to the Web Console endpoint from non-WebKit browsers (Internet Explorer, Firefox) which do not send Origin headers ↗
• → Absence of Origin header in multipart/form-data requests to the EAP/WildFly Web Console is a key indicator of potential CSRF exploitation, as only WebKit-derived browsers (Chrome, Safari, Opera) send Origin headers; flag management console requests lacking Origin headers from IE or Firefox user agents ↗
• → Affected browser scope for exploitation is Internet Explorer (all supported versions) and Firefox (all supported versions); correlate Web Console administrative actions with these user agents and missing Origin headers as a detection signal ↗
• → Successful exploitation allows arbitrary changes to the EAP/WildFly instance including altering security policies and network configuration; alert on unexpected administrative changes (security policy or network config modifications) to EAP/WildFly instances correlated with multipart/form-data upload activity ↗

• · Affected versions are EAP 6.3.x, EAP 6.4.x (before 6.4.4), WildFly 8.1.0, WildFly 8.2.0, and WildFly 9.0.x (before 2.0.0.CR9); the vulnerability was introduced via a specific upstream pull request enabling file upload in management operations ↗
• · The CSRF protection via Origin header enforcement is only effective for WebKit-derived browsers; deployments where administrators use Internet Explorer or Firefox remain unprotected until patched, as those browsers do not send Origin headers on cross-origin multipart/form-data requests ↗
• · The vulnerability was introduced by a specific code change (wildfly/wildfly pull #5904, backported to jbossas/jboss-eap pull #932) enabling file upload as part of management operations; patched via RHSA-2015:1904, RHSA-2015:1905, RHSA-2015:1906, RHSA-2015:1907 for respective RHEL versions ↗

CVSS provenance

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

vulncheck 6.8 MEDIUM

vendor_redhat 6.8 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352