Jonathan Gallimore

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its own web.xml security constraints or EJB method permissions. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

تحمي قيود الأمان المنشأة لنقاط نهاية EJB JAX-WS التي تم تكوين المصادقة لها بعض طرق HTTP فقط. يمكن لمهاجم عن بعد غير مصرح له تجاوز المصادقة عن طريق إرسال طلبات باستخدام طريقة HTTP أخرى.

Name of the Vulnerable Software and Affected Versions: Apache TomEE versions 1.0.0 through 1.7.5 Apache TomEE versions 7.0.0-M1 through 7.0.7 Apache TomEE versions 7.1.0 through 7.1.2 Apache TomEE versions 8.0.0-M1 through 8.0.1 Description: The issue is related to authentication errors in the Apache TomEE server application. Exploitation of this issue may allow a remote attacker to elevate privileges, execute arbitrary code, or cause a denial of service. If Apache TomEE is configured to use the embedded ActiveMQ broker and the broker URI includes the `useJMX=true` parameter, a JMX port is opened on TCP port 1099 without authentication. Recommendations: For Apache TomEE versions 1.0.0 through 1.7.5, consider disabling the JMX port on TCP port 1099 until a patch is available. For Apache TomEE versions 7.0.0-M1 through 7.0.7, restrict access to the embedded ActiveMQ broker to minimize the risk of exploitation. For Apache TomEE versions 7.1.0 through 7.1.2, avoid using the `useJMX=true` parameter in the broker URI until the issue is resolved. For Apache TomEE versions 8.0.0-M1 through 8.0.1, consider temporarily disabling the embedded ActiveMQ broker until a patch is available.

A vulnerability exists in Apache Flink where an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data. The attack is possible when running a process with an enabled JMXReporter, with a port configured via `metrics.reporter.reporter name>.port`.