Exploit for Deserialization of Untrusted Data in Redhat Jboss Enterprise Application Platform

githubexploit · 2017-12-22

Description

Exploit for deserialization vulnerability in Redhat Jboss Enterprise Application Platform CVE-2017-12149

Entry point

Parameterpayload · request body

Pathinvoker/readonly

Deserialization gadget in ReadOnlyAccessFilter allows arbitrary code execution via crafted serialized data.

Affected Redhat Jboss Enterprise Application Platform versions

Redhat Jboss Enterprise Application Platform All versions

All known vulnerabilities by product

Red Hat Jboss Enterprise Application Platform Red Hat Jboss Application Server

CVSS 9.8 for CVE-2017-12149

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

86%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

90.7%higher than 99.8% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2024-02-17 22:44

Last Seen:2025-08-31 23:05

Reporter:1337g

Written in:Python

Last commit:2017-12-23

Tags

cve-2017-12149 redhat jboss exploit deserialization vulnerability remote code execution

Other exploits for CVE-2017-12149

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

jboss-_CVE-2017-12149

2026-08-27 KitPloitKITPLOIT

cve-2017-12149-playground

2026-08-27 KitPloitKITPLOIT

jboss-_CVE-2017-12149

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

Exploit Code

README6 lines

## https://sploitus.com/exploit?id=1AF4241D-2905-501B-B285-696EBD3C90BA
# CVE-2017-12149 Coded by 1337g
Usage: CVE-2017-12149.py http://targetip:port/

JBOSS RCE
I have no idea why it doesnot work with https