PT-2018-11443 · Apache+1 · Apache Jmeter+1

Published 2018-02-14 · Updated 2022-05-13 · CVE-2018-1287

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache JMeter versions 2.X through 3.X

Description The issue arises when Apache JMeter is used in Distributed Test mode, which is RMI-based. In this scenario, the jmeter server binds the RMI Registry to a wildcard host, potentially allowing an attacker to access the JMeterEngine and send unauthorized code. This vulnerability is based on the architectural assumption that JMeter is operating on a 'safe' network where all users with access are considered trusted.

Recommendations For Apache JMeter versions 2.X through 3.X, consider restricting access to the RMI Registry to minimize the risk of exploitation, especially when operating in Distributed Test mode. As a temporary workaround, limit the network access to trusted users only, aligning with JMeter's architectural assumption of a 'safe' network.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2018-1287

GHSA-J7J7-G4WW-PXG5

Affected Products

Apache Jmeter

Debian

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2018-1287 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-1287 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1287 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j7j7-g4ww-pxg5 · Vendor Advisory
• http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpYsFx1%2Brwz1A%3Dmc7wAgbDHARyj1VrWNg41y9OySuL1mqw%40mail.gmail.com%3E · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1287 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1287 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1287 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1287 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/jakarta-jmeter · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1287 · Security Note
• https://github.com/apache/jmeter · Note
• https://github.com/apache/jmeter/issues/4677 · Note
• https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E · Note
• https://bz.apache.org/bugzilla/show_bug.cgi?id=62039 · Note