CVE-2024-4029: WildFly Denial of Service in management interface

CVE-2024-4029 · Severity: medium · CVSS 4.1 · Published 2024-05-02

WildFly, a popular Java application server, contains a flaw in its management interface that fails to limit the number of simultaneous connections. An attacker with local access to the server could exhaust system resources by opening too many connections, potentially causing the entire application server to crash or become unresponsive. This would disrupt business operations and any services hosted on the affected server.

Technologies: Red Hat WildFly. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2024-4029 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-4029 being exploited in the wild.
How severe is CVE-2024-4029?
Medium severity, with a CVSS score of 4.1, published 2 May 2024.
Which products and versions are affected?
org.wildfly:wildfly-domain-http (Maven) <= 24.0.0.Final, ECOSYSTEM:introduced=0,last_affected=24.0.0.Final; Red Hat WildFly <= 24.0.0.Final.
Is there a fix for CVE-2024-4029?
A patch was published on 2024-10-14: Red Hat released security updates for JBoss EAP 7.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-4029 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2024-4029?
Check whether you run org.wildfly:wildfly-domain-http (Maven) or Red Hat WildFly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in the WildFly management interface (specifically within the wildfly-domain-http component). The interface lacks a mechanism to configure or enforce a maximum number of concurrent socket connections. An attacker with local access and high privileges can exploit this by opening numerous connections until the system's 'nofile' (number of open files) limit is reached. This results in a Denial of Service (DoS) condition for the WildFly server. While the management interface is typically not exposed to the network by default, the vulnerability poses a risk in environments where local users are untrusted or the interface has been manually exposed. Patches have been released by Red Hat for JBoss EAP versions.

Affected products

  • WildFly WildFly <= 24.0.0.Final
  • Red Hat JBoss Enterprise Application Platform 7.4, 8.0

Identifiers

  • CVE-2024-4029
  • GHSA-x7g6-rwhc-g7mj

Timeline

  • 2024-05-02: disclosed: Vulnerability reported and CVE-2024-4029 assigned
  • 2024-05-02: advisory: GitHub Advisory GHSA-x7g6-rwhc-g7mj published
  • 2024-10-14: patched: Red Hat released security updates for JBoss EAP 7.4
  • 2024-11-04: patched: Red Hat released security updates for JBoss EAP 8.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.