Potential Security Flaw Using MDB During the deployment of a message driven bean, the container creates a connection to the message queue using the user/pwd provided by the deployment descriptor. The authenticated subject created by this operation is bound to the current thread (via the security association class) using a ThreadLocal.
The thread that deploys components existing in the deploy directory at startup is the "main" thread. This means that the "main" thread has a security association. This security association (meaning the Subject bound to the thread by a ThreadLocal) is then copied to every other thread created by JBoss, including the the HTTP processor threads, class loader threads, etc. The very first time the application is accessed using one of the HTTP processor threads, it has the security association create the jms login. Once the processor thread has processed one request, the security association is cleared and functions normally. This is a serious security vulnerability. A partial workaround is to not deploy the MDBs until after JBoss has finished starting up. This prevents the jms-connection user security association from being inherited by the HTTP processor threads. Regards, Eugene View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3863200#3863200 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=3863200 ------------------------------------------------------- This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool for open source databases. Create drag-&-drop reports. Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. Download a FREE copy at http://www.intelliview.com/go/osdn_nl _______________________________________________ JBoss-user mailing list JBoss-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/jboss-user
