Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation via Insecure Reflection in Payara Server
Payara Server 7.2026.1.RC1 HTTP EJB endpoints rely on attacker-controlled reflection and JNDI lookups without authorization, enabling arbitrary EJB method invocation.
Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that depend on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. Remote clients can perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB business methods without sufficient authorization enforcement or input restriction. Both the deprecated InvokeEJBServlet and other endpoints are affected in version 7.2026.1.RC1.
- Endpoints allow remote JNDI lookups and attacker-supplied class resolution
- Relies on attacker-controlled reflection, dynamic class loading, and unsafe deserialization
- Authorization enforcement and input restriction are insufficient, including in deprecated InvokeEJBServlet
- Vendors
- Payara
- Products
- Payara Server
From the original article
Posted by Ron E on Sep 03 Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that rely on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. These endpoints allow remote clients to perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB business methods via reflection without sufficient authorization enforcement or input restriction.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.