Executive brief
WildFly's HAL Console is the web-based management interface used by administrators to configure and monitor application servers. A cross-site scripting vulnerability allows authenticated administrators to inject malicious code that affects other users of the console, risking theft of session credentials or unauthorized administrative actions. Exploitation requires prior authentication with elevated privileges, limiting but not eliminating the risk in multi-user administrative environments.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the HAL Console component (org.jboss.hal:hal-console <= 3.7.7.Final) where user-controllable input is not properly sanitized before being reflected in web page output served to other users. The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation). Attack vector is network-based with high privilege requirements (authenticated users in SuperUser, Admin, or Maintainer groups), no user interaction needed, and results in high impact to confidentiality and integrity. An authenticated attacker can craft payloads to steal session cookies, perform unauthorized administrative actions, or redirect users to malicious sites. The vulnerability affects WildFly and JBoss EAP versions through 7.4.x; patches are available through Red Hat advisories RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, and RHSA-2025:10931 (upgrade to HAL 3.3.27 or later).
Affected products
- Red Hat JBoss Enterprise Application Platform 7.4 and earlier
- Red Hat WildFly all versions
- JBoss HAL Console <= 3.7.7.Final
Timeline
- 2025-01-14: disclosed
- 2025-01-14: advisory: GHSA-5wjw-h8x5-v65m published
- 2025-01-16: other: Advisory withdrawn as duplicate of GHSA-jhvj-f397-8w6q
- 2025-07-14: patched: Red Hat issued security updates (RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, RHSA-2025:10931) with HAL 3.3.27