By listing and inspecting the MBeans exposed by the JMX on localhost, port 9999, the following attack vectors have been identified:
- Arbitrary File Write using Log4J
- Arbitrary File Read using Log4J
Note: Unlike the “MLet attack” presented in CVE-2023-26269, this vulnerability also works if authentication is required, if the attacker knows the JMX credentials.
This vulnerability represents an alternative attack vector for CVE-2023-26269, therefore the vendor's disclosure and fix for this vulnerability can be found here.
More details and the exploitation process can be found in this PDF.