Miggo Logo

CVE-2017-7556: Cross-Site Request Forgery in hawtio

8.8

CVSS Score
3.0

Basic Information

EPSS Score
0.48356%
Published
5/13/2022
Updated
2/2/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
io.hawt:projectmaven< 1.5.41.5.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description and mitigation steps explicitly reference improper CORS configuration in Jolokia (via jolokia-access.xml). Hawtio relies on Jolokia for JMX-over-HTTP communication, and the lack of strict origin checking in Jolokia's default configuration allowed cross-origin requests to execute privileged actions. The absence of CSRF tokens or origin validation in the affected endpoints made them vulnerable. While no specific function names are provided in the advisory, the root cause lies in Jolokia's CORS handling logic, which is part of hawtio's integration with Jolokia.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

It w*s *oun* t**t **wtio *ont*ins * *SR* *l*w t**t *llows unr*l*t** w**sit*s to p*r*orm **tions *s t** *ut**nti**t** us*r. *tt**k*rs *oul* us* t*is vuln*r**ility to tri*k t** us*r to visit *is w**sit* t**t *ont*ins * m*li*ious s*ript w*i** **n ** su*

Reasoning

T** vuln*r**ility **s*ription *n* miti**tion st*ps *xpli*itly r***r*n** improp*r *ORS *on*i*ur*tion in Joloki* (vi* `joloki*-****ss.xml`). **wtio r*li*s on Joloki* *or JMX-ov*r-*TTP *ommuni**tion, *n* t** l**k o* stri*t ori*in ****kin* in Joloki*'s *