Description

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T03:17:36.463Z",
  "pubdate": "2026-08-11T03:17:36.463Z",
  "executiveSummary": "A vulnerability has been identified in wildfly-core that allows authenticated users with specific privileges to compromise the target system.\nThe vulnerability type involves improper access control and untrusted archive deployment leading to arbitrary file read capabilities.\nThe affected product is wildfly-core, specifically impacting systems utilizing its internal deployment and library functionalities.\nThe risk implications include potential full system compromise, unauthorized data access, and further post-exploitation activities stemming from arbitrary file read vectors.\nAttacker capabilities require authenticated access specifically through a 'deployer' account to successfully interact with the deployment subsystem.\nExploitation requirements dictate that the attacker must leverage internal WildFly libraries to programmatically craft a malicious Java project and execute an HTTP POST request to upload and deploy the malicious archive file from an untrusted source.",
  "technicalDetails": "The root cause of the vulnerability lies within the deployment and management subsystem of wildfly-core, which insufficiently validates and restricts archive files imported and deployed by users possessing the 'deployer' role.\nThe vulnerable component involves the WildFly libraries responsible for handling archive ingestion, deployment parsing, and subsystem integration.\nAuthentication and privilege requirements mandate that the remote attacker must possess valid credentials associated with an authenticated 'deployer' account within the application server environment.\nNetwork exposure typically involves the management interface or application deployment endpoints configured to accept HTTP POST requests for administrative and deployment operations.\nThe exploitation method begins when the attacker leverages legitimate WildFly libraries to programmatically construct a specialized Java project designed to interact with the server's deployment API.\nThe attack flow proceeds as follows: First, the attacker authenticates to the target system using the 'deployer' account. Second, the attacker uses the custom-crafted Java project to formulate an HTTP POST request containing a malicious archive file sourced from an untrusted location. Third, the application server processes the incoming HTTP POST request and initiates the import and deployment of the malicious archive.\nUpon successful deployment, the payload behavior executes within the context of the application server runtime, leveraging the privileges of the server process.\nThe post-exploitation impact includes the ability to execute further malicious logic contained within the deployed archive, ultimately leading to severe security consequences such as arbitrary file read vulnerabilities and potential escalation of privileges across the host environment."
}