Exploit for CVE-2017-12149

kitploit · 2026-08-25

Description

RCE in JBoss via Java Deserialization; Python script uses ysoserial to generate payload dynamically.

Entry point

Parameterpayload · request body

Pathinvoker/readonly

Deserialization gadget in ReadOnlyAccessFilter allows arbitrary code execution via crafted serialized data.

Affected Redhat Jboss Enterprise Application Platform versions

Redhat Jboss Enterprise Application Platform All versions

All known vulnerabilities by product

Red Hat Jboss Enterprise Application Platform Red Hat Jboss Application Server

CVSS 9.8 for CVE-2017-12149

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-08-25 23:15

Last Seen:2026-08-26 01:50

Reporter:KitPloit

Tags

JBossJava DeserializationRemote Code ExecutionysoserialPython scriptpayload generation

Other exploits for CVE-2017-12149

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

jboss-_CVE-2017-12149

2026-08-27 KitPloitKITPLOIT

cve-2017-12149-playground

2026-08-27 KitPloitKITPLOIT

jboss-_CVE-2017-12149

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-JREPPIKS-CVE-2017-12149
# CVE-2017-12149

Jboss Java 역직렬화 RCE (CVE-2017-12149) 이 파이썬 스크립트는 ysoserial을 사용하여 동적으로 페이로드를 생성합니다. 따라서 Java도 필요합니다.