Apache JMeter RMI Registry Binding Vulnerability (CVE-2018-1287)
Summary
CVE-2018-1287: In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. Affects jakarta-jmeter across 30 version ranges.
< 1c14d5444da52e2a7a0b24bc9e0ab14d4fb107e8
< 1e82caeb99968f978045b809b2f8b275bca482c5
< 5fcb29be57044fcac10909e56271f0bada363a76
< 9d0043f84b51275632c0bea3c788662439170b59
< 9e3f9a87bd50c1bd601850e22a63120b4ce95bda
< 25be4f7a5beb07e4b1331cc9cd18597e5bf4323f
< 45c45c75c7cc9dfdde1cc071b6fd44bbd061612d
< 77dc9c6f421f5e187ccddaa0e56906ea8038d5e9
< 79d6b616e98ba4d3cdec6d1dfd79d7e0e712bfa9
< 084e556261e78686c4441f0b7392e80d5ec27d3a
< 103c7b7e3867fc0734dd4792fa9262ded43cd3e0
< 120b62413c6f23a54fb5100f03999494bbcd0c97
< 632b1c00305a007b24fa6402e89f47bbd33d0937
< 842d0a86e7bfa1319ac93f54ad5fefac1a72893d
< 1390e907b2f1acab3d8b905e318ab5d98129e1f4
< 37073e1e60c82217aa649632972f86b1ed91b72c
< 67756c23fa43e789a57306bbf26b78f403717db8
< 71406cf08b85b5f676c09f110332762723cd5485
< 97362d3749bdf98a71ded7234a9b750676c5e4c9
< 1832504fce021b9d95c09b39a12b2086ef5ff538
< 2560016525c565e5fd537259c132bab93f341bd9
< a8ec1a4f256724c7f7ea8f8f393e560618518ba4
< a37fc74b7c72db0c791c9f9f6eb4b88a0b7629f7
< a5795794482df49d9c27d9feffcf7800dc5168c7
< ab1b9a0342d02c1ead42bccf2eb1227a3d21dcc1
< c24e2f10bc8ae9f1ad30ae51d50721b73fa0f575
< cde7646371e8c03c0a17131b12521e5fc389ef95
< dbe970241257c1d73952d5da3e06da8e2cb75d3f
< e66a5e0fa7682cd4e439077a0e31410e79b03b49
< f0a392beb0f80317fbdda473532c559fef5b8beb
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache JMeter is an open-source load testing tool used for analyzing and measuring the performance of web applications. It allows users to simulate heavy loads on a server, test its strength, and analyze its overall performance. The vulnerability, CVE-2018-1287, affects Apache JMeter versions 2.X and 3.X when using Distributed Test only (RMI based). In this configuration, the JMeter server binds the RMI Registry to a wildcard host, which can potentially allow an attacker to gain unauthorized access to the JMeterEngine and execute unauthorized code.
Vulnerability Detail
The vulnerability arises due to the insecure binding of the RMI Registry to a wildcard host. By exploiting this vulnerability, an attacker can gain access to the JMeterEngine and execute unauthorized code. This can lead to various security risks, including unauthorized access to sensitive data, manipulation of test results, and potential disruption of the tested application's functionality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can modify the JMeter configuration to bind the RMI Registry to a specific IP address instead of a wildcard host. By specifying a specific IP address, the exposure to potential attacks can be reduced. The following code snippet demonstrates how to modify the JMeter configuration file (jmeter.properties) to bind the RMI Registry to a specific IP address:
# Set the RMI Registry binding address
remote_hosts=192.168.1.100
Replace '192.168.1.100' with the desired IP address.
Conclusion
The Apache JMeter RMI Registry Binding Vulnerability (CVE-2018-1287) poses a significant security risk to systems using Apache JMeter in a Distributed Test (RMI based) configuration. It is crucial to promptly address this vulnerability by upgrading to a patched version of Apache JMeter and implementing the recommended security measures. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jakarta-jmeter →
FAQ
Apache JMeter is an open-source load testing tool used for analyzing and measuring the performance of web applications.
The vulnerability allows an attacker to gain unauthorized access to the JMeterEngine and execute unauthorized code, potentially leading to unauthorized access to sensitive data, manipulation of test results, and disruption of the tested application's functionality.
To fix the vulnerability, it is recommended to upgrade to a patched version of Apache JMeter. The Apache Software Foundation has released a fix for this vulnerability in later versions of JMeter. Users should update their JMeter installations to the latest version available.
Yes, a workaround is to modify the JMeter configuration to bind the RMI Registry to a specific IP address instead of a wildcard host. This reduces the exposure to potential attacks.
For more information on CVE-2018-1287, including technical details and the latest updates, refer to the official CVE database or the Apache JMeter project website.
Related vulnerabilities
Recent vulnerabilities recorded for jakarta-jmeter.
