CVE-2019-18572 – CVE-2019-18572 allows unauthenticated remote at... (How to Fix)

Q: What is the severity of CVE-2019-18572?

CVE-2019-18572 has a CVSS score of 9.8 (CRITICAL). CVE-2019-18572 allows unauthenticated remote attackers to connect to Java JMX agents in RSA Identity Governance and Lifecycle/Via Lifecycle and Governance products using plain text passwords. This enables monitoring and management of Java applications without authentication. Organizations running affected RSA products prior to version 7.1.1 P03 are vulnerable.

📋 TL;DR

CVE-2019-18572 allows unauthenticated remote attackers to connect to Java JMX agents in RSA Identity Governance and Lifecycle/Via Lifecycle and Governance products using plain text passwords. This enables monitoring and management of Java applications without authentication. Organizations running affected RSA products prior to version 7.1.1 P03 are vulnerable.

💻 Affected Systems

Products:

RSA Identity Governance and Lifecycle
RSA Via Lifecycle and Governance

Versions: All versions prior to 7.1.1 P03

Operating Systems: All supported platforms

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in the Java JMX agent configuration with plain text password authentication enabled by default.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the RSA governance system, allowing attackers to execute arbitrary code, steal sensitive identity data, manipulate user permissions, and pivot to other systems in the network.

🟠

Likely Case

Unauthorized access to JMX management functions, enabling attackers to monitor application performance, modify configurations, deploy malicious code, and potentially escalate privileges within the application.

🟢

If Mitigated

Limited impact with proper network segmentation and authentication controls, though the vulnerability still exposes management interfaces to potential abuse.

🌐 Internet-Facing: HIGH - If JMX ports are exposed to the internet, attackers can directly exploit this without any authentication.

🏢 Internal Only: HIGH - Even internally, any user or compromised system on the network can exploit this vulnerability without credentials.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only JMX client tools (like JConsole or JMXTerm) and knowledge of the JMX port. No special exploit code needed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 7.1.1 P03 or later

Vendor Advisory: https://community.rsa.com/docs/DOC-109310

Restart Required: Yes

Instructions:

1. Download patch 7.1.1 P03 or later from RSA support portal. 2. Backup current configuration and data. 3. Apply patch following RSA installation guide. 4. Restart all RSA services. 5. Verify JMX authentication is properly configured.

🔧 Temporary Workarounds

Disable JMX Remote Access

all

Disable remote JMX connections entirely if not required for monitoring

Edit Java startup parameters to remove: -Dcom.sun.management.jmxremote
-Dcom.sun.management.jmxremote.port=PORT
-Dcom.sun.management.jmxremote.authenticate=false

Enable JMX Authentication with SSL

all

Configure JMX with proper authentication and SSL encryption

Set Java parameters: -Dcom.sun.management.jmxremote.authenticate=true
-Dcom.sun.management.jmxremote.ssl=true
-Dcom.sun.management.jmxremote.password.file=/path/to/jmxremote.password
-Dcom.sun.management.jmxremote.access.file=/path/to/jmxremote.access

🧯 If You Can't Patch

Implement strict network segmentation to isolate RSA systems from untrusted networks
Configure firewall rules to block all inbound connections to JMX ports (default 1099, 9010)

🔍 How to Verify

Check if Vulnerable:

Check if JMX is enabled without authentication by running: netstat -an | grep LISTEN | grep -E '(1099|9010)' and verify Java startup parameters contain -Dcom.sun.management.jmxremote.authenticate=false

Check Version:

Check RSA product version through admin console or product documentation

Verify Fix Applied:

Attempt to connect to JMX port using JConsole or JMXTerm without credentials - connection should be rejected. Verify version is 7.1.1 P03 or later.

📡 Detection & Monitoring

Log Indicators:

Failed JMX authentication attempts
Unauthorized JMX connections in Java application logs
Unexpected JMX MBean operations

Network Indicators:

Unencrypted JMX traffic on ports 1099/9010
JMX connections from unexpected IP addresses
JMX protocol anomalies

SIEM Query:

source="*java*" AND ("JMX" OR "com.sun.management.jmxremote") AND ("authentication failed" OR "unauthorized access")

📊 Metadata

CVE ID: CVE-2019-18572

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-306

Published: December 18, 2019

Last Updated: November 21, 2024

🔗 References

https://community.rsa.com/docs/DOC-109310 Vendor Advisory
https://community.rsa.com/docs/DOC-109310 Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2019-18572, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

Rsa Identity Governance And Lifecycle by Dell

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable JMX Remote Access

Enable JMX Authentication with SSL

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities