CVE-2023-28462
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Payara Server by exploiting a JNDI rebind operation in the default ORB listener. It affects Payara Server Enterprise and Community editions running on Java 1.8u181 or earlier. Successful exploitation enables complete server compromise.
💻 Affected Systems
- Payara Server Enterprise
- Payara Server Community
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data exfiltration, ransomware deployment, or lateral movement within the network.
Likely Case
Remote code execution allowing attackers to install backdoors, steal sensitive data, or use the server as part of a botnet.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires JNDI directory scan but is straightforward once that condition is met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Payara Server 5.2020.6 (Community) or latest Enterprise release
Vendor Advisory: https://blog.payara.fish/vulnerability-affecting-server-environments-on-java-1.8-on-updates-lower-than-1.8u191
Restart Required: Yes
Instructions:
1. Backup your configuration and applications. 2. Download the patched version from Payara's website. 3. Stop the Payara Server. 4. Install the updated version. 5. Restore configuration and applications. 6. Restart the server.
🔧 Temporary Workarounds
Upgrade Java Runtime
allUpdate Java to version 1.8u191 or later to mitigate the vulnerability
sudo apt update && sudo apt install openjdk-8-jdk
yum update java-1.8.0-openjdk
Disable ORB Listener
allDisable the vulnerable ORB listener in Payara Server configuration
asadmin set configs.config.server-config.iiop-service.iiop-listener.orb-listener.enabled=false
🧯 If You Can't Patch
- Implement strict network access controls to limit ORB listener exposure
- Deploy web application firewall (WAF) rules to block JNDI rebind attempts
🔍 How to Verify
Check if Vulnerable:
Check Payara version with: asadmin version && check Java version with: java -versionCheck Version:
asadmin versionVerify Fix Applied:
Verify Payara version is 5.2020.6+ (Community) or latest Enterprise, and Java is 1.8u191+📡 Detection & Monitoring
Log Indicators:
- Unusual JNDI lookup patterns
- ORB listener access from unexpected sources
- Class loading from remote sources
Network Indicators:
- Traffic to ORB listener port (default 3700) from untrusted sources
- JNDI LDAP/RMI requests to suspicious domains
SIEM Query:
source="payara.log" AND ("JNDI" OR "ORB") AND ("rebind" OR "lookup")