Executive brief
WildFly, a popular Java application server, contains a flaw in its management interface that fails to limit the number of simultaneous connections. An attacker with local access to the server could exhaust system resources by opening too many connections, potentially causing the entire application server to crash or become unresponsive. This would disrupt business operations and any services hosted on the affected server.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the WildFly management interface (specifically within the wildfly-domain-http component). The interface lacks a mechanism to configure or enforce a maximum number of concurrent socket connections. An attacker with local access and high privileges can exploit this by opening numerous connections until the system's 'nofile' (number of open files) limit is reached. This results in a Denial of Service (DoS) condition for the WildFly server. While the management interface is typically not exposed to the network by default, the vulnerability poses a risk in environments where local users are untrusted or the interface has been manually exposed. Patches have been released by Red Hat for JBoss EAP versions.
Affected products
- WildFly WildFly <= 24.0.0.Final
- Red Hat JBoss Enterprise Application Platform 7.4, 8.0
Timeline
- 2024-05-02: disclosed: Vulnerability reported and CVE-2024-4029 assigned
- 2024-05-02: advisory: GitHub Advisory GHSA-x7g6-rwhc-g7mj published
- 2024-10-14: patched: Red Hat released security updates for JBoss EAP 7.4
- 2024-11-04: patched: Red Hat released security updates for JBoss EAP 8.0