V-217099

Discussion

JBoss provides multiple interfaces for accessing the system. By default, these are called "public" and "management". Allowing non-management traffic to access the JBoss management interface increases the chances of a security compromise. The JBoss server must be configured to bind the management interface to a network that controls access. This is usually a network that has been designated as a management network and has restricted access. Similarly, the public interface must be bound to a network that is not on the same segment as the management interface.

Check Content

Obtain documentation and network drawings from system admin that shows the network interfaces on the JBoss server and the networks they are configured for.

If a management network is not used, you may substitute localhost/127.0.0.1 for management address.  If localhost/127.0.0.1 is used for management interface, this is not a finding.

From the JBoss server open the web-based admin console by pointing a browser to HTTP://127.0.0.1:9990.
Log on to the management console with admin credentials.
Select "RUNTIME". 
Expand STATUS by clicking on +.
Expand PLATFORM by clicking on +.
In the "Environment" tab, click the > arrow until you see the "jboss.bind.properties" and the "jboss.bind.properties.management" values.

If the jboss.bind.properties and the jboss.bind.properties.management do not have different IP network addresses assigned, this is a finding.

Review the network documentation.  If access to the management IP address is not restricted, this is a finding.