CVE-2023-28462: Payara Server RCE Vulnerability

CVE-2023-28462 Overview

CVE-2023-28462 is a critical insecure deserialization vulnerability affecting Payara Server's default ORB (Object Request Broker) listener. The vulnerability allows remote attackers to perform a JNDI rebind operation that can load and execute malicious code on the server when a JNDI directory scan is performed. This attack is possible on systems running vulnerable versions of Payara Server with Java 1.8u181 or earlier.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary code execution on affected Payara Server instances by exploiting the JNDI rebind functionality in the default ORB listener, potentially leading to complete server compromise.

Affected Products

• Payara Server 4.1.2.191 (Enterprise)
• Payara Server 5.20.0 and newer (Enterprise)
• Payara Server 5.2020.1 and newer (Community)
• Oracle JDK 1.8.0 update 181 and earlier

Discovery Timeline

• 2023-03-30 - CVE CVE-2023-28462 published to NVD
• 2025-02-18 - Last updated in NVD database

Technical Details for CVE-2023-28462

Vulnerability Analysis

This vulnerability exploits a weakness in the Java Naming and Directory Interface (JNDI) implementation within Payara Server's default ORB listener. JNDI provides a unified interface for looking up and managing resources in directory services. When combined with older versions of Java (1.8u181 and earlier), the ORB listener does not properly restrict JNDI rebind operations, allowing attackers to inject malicious object references into the naming directory.

The attack leverages the insecure deserialization behavior present in older Java versions, where remote class loading was enabled by default. When a legitimate application or administrative process performs a JNDI directory scan, the malicious rebind entry triggers the loading and instantiation of attacker-controlled classes from a remote location.

Root Cause

The root cause stems from two converging factors: insufficient validation of JNDI rebind operations in Payara Server's ORB listener, and the permissive remote class loading behavior in Java 1.8u181 and earlier. The ORB listener accepts rebind requests without proper authentication or authorization checks, and older Java versions do not implement the security restrictions that were added in Java 1.8u191 to prevent JNDI-based remote code loading attacks.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can remotely connect to the ORB listener and submit a crafted JNDI rebind request containing a reference to a malicious class hosted on an attacker-controlled server. The malicious payload is executed when any JNDI lookup or directory scan operation encounters the poisoned entry.

The exploitation flow involves establishing a connection to the target's ORB listener port, submitting a rebind operation with a malicious JNDI reference pointing to attacker infrastructure, and waiting for a JNDI lookup to trigger the remote class loading. The vulnerability is particularly dangerous in environments where automated monitoring or administrative tools regularly perform JNDI directory scans.

Detection Methods for CVE-2023-28462

Indicators of Compromise

• Unusual outbound connections from the Payara Server to external hosts on LDAP (port 389/636) or RMI (port 1099) ports
• Unexpected JNDI rebind operations in ORB listener logs
• Suspicious class loading activity from remote URLs in Java process logs
• New or modified entries in the JNDI naming directory that were not created by authorized processes

Detection Strategies

• Monitor network traffic for connections from Payara Server instances to untrusted external IP addresses, particularly on LDAP and RMI ports
• Implement application-level logging for JNDI operations and alert on rebind requests from non-administrative sources
• Deploy endpoint detection rules to identify Java processes loading classes from remote HTTP/LDAP URLs
• Review Payara Server access logs for connections to the ORB listener from unexpected source addresses

Monitoring Recommendations

• Enable verbose logging for the Payara Server ORB listener and JNDI subsystem
• Configure network security monitoring to baseline and alert on deviations in Payara Server's outbound connection patterns
• Implement file integrity monitoring on Payara Server configuration and deployment directories
• Deploy SIEM rules to correlate ORB listener access with subsequent remote class loading events

How to Mitigate CVE-2023-28462

Immediate Actions Required

• Upgrade Java runtime to version 1.8u191 or later, which includes security restrictions on JNDI remote class loading
• Restrict network access to the ORB listener port using firewall rules, allowing only trusted administrative hosts
• Review and remove any suspicious entries in the JNDI naming directory
• Consider disabling the default ORB listener if it is not required for application functionality

Patch Information

Payara has published a security advisory addressing this vulnerability. Organizations should consult the Payara Blog Vulnerability Advisory for detailed guidance on remediation steps. The primary mitigation involves upgrading the underlying Java runtime to version 1.8u191 or later, which implements security restrictions that prevent the JNDI-based remote code execution attack vector.

Workarounds

• Upgrade Java to version 1.8u191 or later to enable built-in protections against JNDI-based attacks
• Configure firewall rules to restrict access to the ORB listener port (typically 3700) from untrusted networks
• Set the com.sun.jndi.ldap.object.trustURLCodebase system property to false if running on older Java versions
• Disable remote class loading by setting com.sun.jndi.rmi.object.trustURLCodebase to false

# Configuration example
# Java system properties to disable JNDI remote class loading
# Add these to your Payara Server JVM options

# Disable LDAP-based remote class loading
-Dcom.sun.jndi.ldap.object.trustURLCodebase=false

# Disable RMI-based remote class loading  
-Dcom.sun.jndi.rmi.object.trustURLCodebase=false

# Disable CORBA-based remote class loading
-Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false