CVE-2018-1000129: Cross-site Scripting in Jolokia agent
Summary
CVE-2018-1000129: Cross-site Scripting in Jolokia agent. Affects org.jolokia:jolokia-core versions >= 1.3.7, < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jolokia agent is a Java library that provides an HTTP/JSON interface for remote JMX access. It allows users to interact with JMX MBeans (Managed Beans) over HTTP using JSON. The agent is commonly used in Java applications to monitor and manage JMX resources. However, version 1.3.7 of the Jolokia agent is vulnerable to a cross-site scripting (XSS) attack. This vulnerability exists in the HTTP servlet and can be exploited by an attacker to execute malicious JavaScript code in the victim's browser.
Vulnerability Detail
The XSS vulnerability in the Jolokia agent version 1.3.7 allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the victim. The vulnerability is rated as moderate severity with a CVSS score of 6.1. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-79.
How To Fix
Minimum fixed version
1.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not feasible, a temporary workaround is to disable or restrict access to the Jolokia agent servlet. This can be done by modifying the application's web.xml or servlet configuration to block access to the Jolokia servlet URL. Here's an example of how to restrict access using a servlet filter:
<filter> ``` <filter-name>JolokiaFilter</filter-name> <filter-class>com.example.JolokiaFilter</filter-class> ``` </filter><filter-mapping>
<filter-name>JolokiaFilter</filter-name>
<url-pattern>/jolokia/*</url-pattern>
</filter-mapping>
The JolokiaFilter class should implement the javax.servlet.Filter interface and handle the filtering logic.
Conclusion
The Jolokia agent version 1.3.7 is vulnerable to a cross-site scripting (XSS) attack. To mitigate this vulnerability, it is recommended to upgrade to version 1.5.0 or later. If upgrading is not feasible, you can apply a temporary workaround by disabling or restricting access to the Jolokia agent servlet. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jolokia:jolokia-core →
FAQ
The vulnerability allows an attacker to execute malicious JavaScript code in the victim's browser, potentially leading to session hijacking, data theft, and unauthorized actions on behalf of the victim.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, upgrading the Jolokia agent to version 1.5.0 or later will fix the XSS vulnerability. Update the dependency in your Maven project to the latest version.
Yes, you can temporarily disable or restrict access to the Jolokia agent servlet by modifying the application's configuration. Refer to the 'workaround' section for more details.
The vulnerability is rated as moderate severity with a CVSS score of 6.1.
Related vulnerabilities
Recent vulnerabilities recorded for org.jolokia:jolokia-core.
