CVE report
CVE-2017-12149criticalKEV
Jboss Application Server - Remote Code Execution
Events 90d
81
Distinct IPs
11
Severity
critical
CISA KEV
Actively exploited
Detection signature
An event counts toward CVE-2017-12149 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /invoker/readonly
- · /invoker/EJBInvokerServlet
- · /invoker/JMXInvokerServlet
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 8 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2017-12149
- 219.151.190.16516 eventsChina· Chongqing Telecom
- 72.167.44.20516 eventsUnited States· GoDaddy.com, LLC
- 222.211.66.2816 eventsChina· CHINANET SiChuan Telecom Internet Data Center
- 190.80.139.1568 eventsDominican Republic· Compania Dominicana de Telefonos S. A.
- 4.193.139.298 eventsSingapore· Microsoft Corporation
- 190.167.169.2054 eventsDominican Republic· Compania Dominicana de Telefonos S. A.
- 211.101.237.844 eventsChina· Cloud Computing Corporation
- 115.171.80.2533 eventsChina· China Networks Inter-Exchange
- 101.36.125.583 eventsHong Kong· UCLOUD INFORMATION TECHNOLOGY HK LIMITED
- 38.76.165.2072 eventsUnited States· Cogent Communications, LLC
- 13.68.133.981 eventsUnited States· Microsoft Corporation
Top networks the attempts come from
- AS134420 Chongqing Telecom1 IPs · 16 ev
- AS398101 GoDaddy.com, LLC1 IPs · 16 ev
- AS38283 CHINANET SiChuan Telecom Internet Data Center1 IPs · 16 ev
- AS6400 Compania Dominicana de Telefonos S. A.2 IPs · 12 ev
- AS8075 Microsoft Corporation2 IPs · 9 ev
- AS58519 Cloud Computing Corporation1 IPs · 4 ev
- AS4847 China Networks Inter-Exchange1 IPs · 3 ev
- AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED1 IPs · 3 ev
- AS174 Cogent Communications, LLC1 IPs · 2 ev
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
Sample request paths observed
- /invoker/JMXInvokerServlet/
- /invoker/EJBInvokerServlet
- /invoker/EJBInvokerServlet/
- /invoker/readonly
- /invoker/JMXInvokerServlet