Jonathan Gallimore

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its own web.xml security constraints or EJB method permissions. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Security constraints for EJB JAX-WS endpoints with configured authentication only protect specific HTTP methods. This allows a remote unauthenticated attacker to bypass authentication by utilizing different HTTP methods when sending requests.

Name of the Vulnerable Software and Affected Versions: Apache TomEE versions 1.0.0 through 1.7.5 Apache TomEE versions 7.0.0-M1 through 7.0.7 Apache TomEE versions 7.1.0 through 7.1.2 Apache TomEE versions 8.0.0-M1 through 8.0.1 Description: The issue is related to authentication errors in the Apache TomEE server application. Exploitation of this issue may allow a remote attacker to elevate privileges, execute arbitrary code, or cause a denial of service. If Apache TomEE is configured to use the embedded ActiveMQ broker and the broker URI includes the `useJMX=true` parameter, a JMX port is opened on TCP port 1099 without authentication. Recommendations: For Apache TomEE versions 1.0.0 through 1.7.5, consider disabling the JMX port on TCP port 1099 until a patch is available. For Apache TomEE versions 7.0.0-M1 through 7.0.7, restrict access to the embedded ActiveMQ broker to minimize the risk of exploitation. For Apache TomEE versions 7.1.0 through 7.1.2, avoid using the `useJMX=true` parameter in the broker URI until the issue is resolved. For Apache TomEE versions 8.0.0-M1 through 8.0.1, consider temporarily disabling the embedded ActiveMQ broker until a patch is available.

A vulnerability exists in Apache Flink where an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data. The attack is possible when running a process with an enabled JMXReporter, with a port configured via `metrics.reporter.reporter name>.port`.