[feature request] Apache Tomcat/JBoss EJBInvokerServlet

Question

[feature request] Apache Tomcat/JBoss EJBInvokerServlet

thsle3p opened this issue 11 years ago · 2 comments

Can a module be added to implement this invoker for jboss http://www.exploit-db.com/exploits/28713/? Some sys admins restrict /invoker/JMXInvokerServlet/ but not /invoker/EJBInvokerServlet/ so it would be good to have a module to exploit that.

Answer 1 · 2014-02-10T16:14:03.000Z

I was under the impression that removing the JMXInvokerServlet was essentially the same as removing the EJBInvokerServlet.

Thanks for opening this issue; I'll get it knocked out. Leaving this open until the commit comes through.

Answer 2 · 2014-02-12T02:22:31.000Z

A deployer for EJBInvokerServlet now in dev; should be available in trunk in the next merge.