CVE-2009-2405

Vulnerability

Multiple reflected cross-site scripting (XSS) vulnerabilities exist in the Web Console of the Application Server in Red Hat JBoss Enterprise Application Platform (JBoss EAP) versions 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA. The affected pages are createSnapshot.jsp and createThresholdMonitor.jsp. Input passed to the parameters monitorName, objectName, attribute, period, threshold, and enabled is not sanitized before being returned to the user, allowing injection of arbitrary HTML and script code [1][2].

Exploitation

An attacker must convince a victim who is logged into the JBoss Web Console to visit a crafted URL containing malicious JavaScript in one of the vulnerable parameters. No authentication is required on the part of the attacker, but the victim must have an active session with the Web Console. The attack is reflected—the malicious payload is not stored on the server but is immediately reflected back in the HTTP response. Initial patches did not cover all injection vectors (e.g., " onmouseover=alert(1) ), requiring revisions [2].

Impact

Successful exploitation allows arbitrary script execution in the victim's browser within the security context of the JBoss Web Console. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The vulnerability does not provide direct server-side access, but it compromises the user's session and data confidentiality/integrity within the Web Console [1][2].

Mitigation

Red Hat released updates in RHSA-2009:1649 for JBoss EAP 4.2.0 CP08, 4.3.0 CP07, and later versions. For JBoss EAP 5.1.0GA, an upgrade to a patched release (e.g., 5.1.1GA) or applying the vendor-provided patch is required. Workarounds include restricting network access to the Web Console or disabling it if not needed. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1][2].