Authentication Bypass in Wildfly IIOP EJB

Executive Summary

This vulnerability in WildFly allows a remote attacker to bypass authentication on IIOP EJB invocations. The CSIv2 security interceptor accepts identity assertions without verifying transport-level authentication, letting an attacker on port 3528 impersonate any principal on every IIOP-exposed @Remote EJB.

Useful 0 Not Useful 0

Detection Guidance

Check if IIOP port 3528 is exposed to untrusted networks. Use netstat or ss to verify listening ports: netstat -tulnp | grep 3528 or ss -tulnp | grep 3528. Inspect WildFly configuration for caller propagation settings in standalone.xml or domain.xml. Look for <subsystem xmlns="urn:jboss:domain:iiop-openjdk:..."> and verify caller-propagation is set to 'none'.

Useful 0 Not Useful 0

Impact Analysis

An attacker could impersonate users, gain unauthorized access to sensitive data, or perform actions on behalf of other principals. Exploitation requires access to port 3528 and specific non-default configurations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be compromised if attacker gains access to protected data.

Useful 0 Not Useful 0

Mitigation Strategies

Set caller propagation to 'none' in WildFly configuration. Restrict access to port 3528 using firewall rules (e.g., iptables -A INPUT -p tcp --dport 3528 -j DROP). Enforce SSL/TLS and client certificate authentication if caller propagation is required. Reload the runtime service after changes.

Useful 0 Not Useful 0