Description

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-11T09:17:13.233Z",
  "pubdate": "2026-08-11T09:17:13.233Z",
  "executiveSummary": "A critical unauthenticated bind vulnerability exists within the IIOP (Internet Inter-ORB Protocol) implementation of EAP, specifically affecting the listener's NameService component.\nThe flaw permits unauthorized remote actors to execute binding operations against the naming service without requiring any form of authentication or prior validation.\nSuccessful exploitation of this security deficiency enables malicious actors to hijack Java Naming and Directory Interface (JNDI) lookups, forcibly rebinding them to a malicious Object Request Broker (ORB).\nThe primary business and operational impacts include the realization of Man-in-the-Middle (MITM) interception capabilities and Denial of Service (DoS) conditions on subsequent method invocations across dependent applications.\nThe attack vector is network-accessible, requiring no privileged access or valid credentials within the target environment, significantly lowering the barrier to exploitation for unauthorized network participants.\nRisk implications are severe, as compromised JNDI lookups can lead to intercepted sensitive data flows, service degradation, and systemic integrity compromises within distributed enterprise architectures relying on vulnerable EAP IIOP services.",
  "technicalDetails": "The vulnerability resides in the IIOP listener component of EAP, specifically within the NameService architecture responsible for handling distributed object references and naming operations.\nThe fundamental root cause is the absence of access control checks and authentication enforcement for incoming bind operations sent to the NameService.\nBecause the listener accepts remote bind requests unconditionally, an unauthenticated attacker positioned on the network can manipulate the naming context.\nThe attack flow proceeds as follows: First, the attacker identifies the network endpoint hosting the vulnerable IIOP listener and NameService. Second, the attacker crafts a malicious IIOP request containing a bind or rebind operation targeting a specific JNDI lookup name. Third, the attacker substitutes the legitimate object reference with a reference pointing to a malicious ORB controlled by the attacker. Fourth, when legitimate clients or application components attempt to resolve the affected JNDI lookup, the naming service returns the malicious ORB reference instead of the authentic endpoint. Finally, subsequent object invocations from the client are routed through the attacker-controlled ORB.\nThis manipulation facilitates sophisticated Man-in-the-Middle (MITM) attacks, allowing the adversary to intercept, inspect, modify, or drop traffic intended for legitimate backend services. Alternatively, the attacker can supply invalid or non-functional routing parameters, inducing a permanent Denial of Service (DoS) for all further invocations reliant on the hijacked JNDI bindings.\nThe vulnerable component is the EAP IIOP NameService binding mechanism. Exploitation requires network access to the IIOP listener port, but does not necessitate authentication credentials or specialized privileges on the target system."
}