CVE-2019-4279
published 2019-05-17CVE-2019-4279: IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of…
PriorityP182critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
79.93%
99.6th percentile
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | 8.5.0.0 – 8.5.5.15 | — |
| ibm | websphere_application_server | 9.0.0.0 – 9.0.0.11 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0x396fb74a
- →Detect exploit traffic by matching the 4-byte magic header 0x396fb74a at the start of TCP packets on WAS DMGR ports (11002, 11004, 11006, etc.) over SSLv3 ↗
- →Monitor for Java deserialized objects containing class names com.ibm.son.mesh.Message, com.ibm.son.mesh.BcastFloodMsg, or com.ibm.son.mesh.TcpNodeMessage in network traffic to WAS DMGR ports ↗
- →The exploit requires a 2-minute delay between attempts due to neighbor reset; repeated connection attempts to DMGR ports with ~120s intervals may indicate exploitation attempts ↗
- ·The exploit targets Windows platforms only (win x86/x64 or CMD); Linux/Unix WAS deployments are not targeted by this specific module ↗
- ·Exploitation requires elevated/privileged access on the target; the module is marked Privileged => true ↗
- ·The Metasploit module references CVE-2019-8352 in its References block, which may differ from the NVD-assigned CVE-2019-4279; verify the correct CVE mapping before using for tracking ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.0CRITICALCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit)
exploitdb·2019-06-05
CVE-2019-8352 IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit)
IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution',
'Description' => %(
This module exploits untrusted serialized data processed by the WAS DMGR Server and Cells.
NOTE: There is a required 2 minute timeout between attempts as the neighbor being added must be reset.
),
'License' => MSF_LICENSE,
'Author' =>
[
'b0yd' # @rwincey of [Securifera](https://www.securifera.com/) / Vulnerability Discovery and MSF module author
],
'References' =>
[
['CVE', '2019-8
Metasploit
IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution
metasploit
IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution
IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution
This module exploits untrusted serialized data processed by the WAS DMGR Server and Cells. NOTE: There is a required 2 minute timeout between attempts as the neighbor being added must be reset.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/108450https://exchange.xforce.ibmcloud.com/vulnerabilities/160445https://www.ibm.com/support/docview.wss?uid=ibm10883628http://www.securityfocus.com/bid/108450https://exchange.xforce.ibmcloud.com/vulnerabilities/160445https://www.ibm.com/support/docview.wss?uid=ibm10883628
2019-05-17
Published