Red Hat JBoss Application Server HTTP Invoker Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2017-12149) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTJBoss Application Server shipped with Red Hat Enterprise Application Platform (EAP) 5.2, specifically when the HTTP Invoker (ReadOnlyAccessFilter) is enabled.
Unauthenticated remote attackers can execute arbitrary OS commands with the privileges of the JBoss process by sending crafted serialized Java objects.
Apply official Red Hat security updates, disable or restrict access to the HTTP Invoker servlet, or block serialization payloads using a Web Application Firewall (WAF).
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade to the latest supported version of JBoss EAP or apply the official errata updates provided by Red Hat. Use the following package manager commands on RHEL-based systems:
# Update JBoss EAP packages via Red Hat Subscription Manager
yum update jbossas-core jbossas-ws-cxf -y2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, secure the environment by disabling the HTTP Invoker servlet mapping in the configuration files.
<!-- Edit web.xml in jboss-web.deployer/conf/ or the respective application deployment -->
<!-- Comment out the ReadOnlyAccessFilter mapping as shown below -->
<!--
<filter-mapping>
<filter-name>ReadOnlyAccessFilter</filter-name>
<url-pattern>/readonly/*</url-pattern>
</filter-mapping>
-->3. Log Audit & IoC Verification Commands
Inspect JBoss access logs for suspicious POST requests targeting the invoker endpoints and search for the presence of the vulnerable class.
# Scan JBoss access logs for HTTP Invoker access attempts returning 200 OK
grep -Ei 'POST .*/invoker/' /var/log/jbossas/access_log*
# Locate JAR files containing the vulnerable ReadOnlyAccessFilter class
find / -name '*.jar' -exec grep -l 'ReadOnlyAccessFilter' {} \; 2>/dev/nullBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the HTTP Invoker component of JBoss Application Server as shipped with Red Hat Enterprise Application Platform (EAP) 5.2. The doFilter method in the ReadOnlyAccessFilter class of the HTTP Invoker does not restrict or validate the classes for which it performs deserialization. Consequently, untrusted user input is directly passed to the Java deserialization API (ObjectInputStream.readObject()), leading to an unsafe deserialization flaw.
2. Exploitation Mechanics & Attack Scenario
An attacker leverages pre-existing gadget chains (such as Apache Commons Collections) within the application's classpath to construct a malicious serialized object payload. The attacker then sends this payload via an HTTP POST request to the vulnerable endpoint (e.g., /invoker/ReadOnlyAccessFilter). When the server deserializes the incoming data, the payload triggers the execution of arbitrary system commands under the security context of the JVM process.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and its inclusion in the CISA KEV catalog, this vulnerability represents a severe threat that is actively exploited in the wild. Successful exploitation allows complete system compromise, enabling attackers to establish persistence, exfiltrate sensitive data, deploy ransomware, or pivot deeper into the internal corporate network.
Official Vendor Advisories & References
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
Frequently Asked SecOps Questions (CVE-2017-12149)
FAQQ1. How critical is CVE-2017-12149 and is it actively exploited in the wild?
CVE-2017-12149 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 90.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2017-12149?
Primary impacted vendors include redhat, jboss across application_server, enterprise_application_platform. Scope summary: Red Hat Enterprise Application Platform (EAP) 5.2 and JBoss Application Server deployments exposing the HTTP Invoker service
Q3. What temporary mitigations or workarounds exist for CVE-2017-12149 before patching?
[Mitigation] Apply official Red Hat security updates, disable or restrict access to the HTTP Invoker servlet, or block serialization payloads using a Web Application Firewall (WAF). Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2017-12149
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (redhat)
View Category →JetBrains TeamCity Unauthenticated Remote Code Execution Vulnerability via Agent Polling Protocol (CVE-2026-63077)
[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7
Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
PTC Windchill and FlexPLM Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-12569)
[Affected Scope] All versions of PTC Windchill PDMlink and FlexPLM prior to 11.0 M030, including all CPS releases.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.