CVE-2015-8965
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary Java code on systems running vulnerable versions of Rogue Wave JViews. The issue exists because the IlvFacesController servlet doesn't properly restrict which servlets can be called, enabling attackers to invoke existing Java classes in the classpath. Organizations using JViews web applications are affected.
💻 Affected Systems
- Rogue Wave JViews
📦 What is this software?
Jviews by Perforce
Jviews by Perforce
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Attackers execute existing Java classes in the classpath, potentially gaining administrative access or performing unauthorized actions.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
The vulnerability requires no authentication and leverages existing Java classes, making exploitation straightforward for attackers with access to the application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.8 patch 21 or 8.9 patch 1
Vendor Advisory: https://rwkbp.makekb.com/?View=entry&EntryID=2521
Restart Required: Yes
Instructions:
1. Download the appropriate patch from Rogue Wave/Oracle. 2. Apply the patch to your JViews installation. 3. Restart the application server. 4. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Remove or Restrict IlvFacesController Servlet
allRemove the vulnerable servlet from web.xml or restrict access to it through security controls.
Edit web.xml to remove <servlet> and <servlet-mapping> entries for ilog.views.faces.IlvFacesController
Network Access Control
allRestrict network access to the affected application using firewalls or network segmentation.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems
- Deploy web application firewall (WAF) rules to block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if jviews-framework-all.jar is present in your application and examine web.xml for IlvFacesController servlet configuration.Check Version:
Check the JViews documentation or application properties for version information.Verify Fix Applied:
Verify the JViews version is 8.8 patch 21 or higher, or 8.9 patch 1 or higher, and that the IlvFacesController servlet is properly secured or removed.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to IlvFacesController servlet
- Java class loading errors or unexpected class executions
Network Indicators:
- HTTP requests to paths associated with IlvFacesController
- Unusual outbound connections from the application server
SIEM Query:
Search for HTTP requests containing 'IlvFacesController' or patterns matching Java class invocation attempts.🔗 References
- https://rwkbp.makekb.com/?View=entry&EntryID=2521
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://rwkbp.makekb.com/?View=entry&EntryID=2521
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
