Description
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 4 | jboss-seam2 +1 | 2.0.2.FP-1.ep1.24.el4 | RHSA-2010:0564 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
JBoss Seam 2 Remote Command Execution
auxiliary/admin/http/jboss_seam_exec
-
JBoss Seam 2 File Upload and Execute
exploit/multi/http/jboss_seam_upload_exec
Exploit-DB 1
- JBoss Seam 2 - Arbitrary File Upload / Execution (Metasploit) EDB-36653 · remote · Apr 6, 2015 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2010:0564 Red Hat Security Advisory: jboss-seam2 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 41994 vdb-entry
- 20130528 CA20130528-01: Security Notice for CA Process Automation (CA PAM) mailing-list
- 1024253 vdb-entry
- ADV-2010-1929 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=615956
- seam-expressions-code-execution(60794) vdb-entry
- RHSA-2010:0564 vendor-advisory
- https://security.netapp.com/advisory/ntap-20161017-0001/