Repository navigation
Don't confirm JBoss CRITICAL from a WAF 401/403 - #40
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
A path-specific 403/401 on /jmx-console or /web-console is a common WAF signature, not evidence of JBoss. Require the existing body keywords so fusion cannot pin an un-droppable false CRITICAL. Co-authored-by: dmitryflynn <dmitryflynn@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug and impact
check_http_admin_panelsauto-confirmed CRITICAL "JBoss JMX Console Exposed" / "JBoss Web Console Exposed" on a path-specific HTTP 401 or 403 for/jmx-consoleand/web-console, with no body keywords.Fusion maps every
service_probe_resultfinding tosource=probe+ high reliability, and the gate pins those as un-droppable. A WAF or deny-rule 403 on those well-known attack paths (ModSecurity CRS, Cloudflare, AWS managed rules) with a normal 404/200 baseline therefore lands in the report, HackerOne export, and executive summary as a confirmed critical.SPA catch-all 200s were already keyword-gated. The 401/403 shortcut bypassed that for JBoss only.
Trigger:
--probe/--full(or any GUI scan) against an HTTP service that:/jmx-consoleor/web-consoleonly.A real JBoss login page that mentions
JMX/JBossstill confirms.Root cause
auth_protected_paneltreated JBoss console paths like Tomcat manager: status 401/403 alone was confirmation. Tomcat stays HIGH and is a Basic-auth challenge. JBoss was CRITICAL, and those paths are standard WAF signatures.Fix
/jmx-consoleand/web-consolein the 401/403 allow-list so a real JBoss login page can still match body keywords.JMX/MBeanorjboss/JBossmarkers, same as the 200 path./manager/html401 behavior is unchanged.Validation
python3 -m pytest test_probers.py test_hardening.py test_fusion_engine_bridge.py test_service_enum.py -q— 104 passed.New cases: WAF 403 on the JBoss paths is not CRITICAL; 401 without markers is not CRITICAL; a JBoss login page with
JMX Console/JBoss Web Consolestill confirms CRITICAL.