Posted by Ron E on Sep 03 Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms

that rely on attacker-controlled reflection, dynamic class loading, and

unsafe deserialization. These endpoints allow remote clients to perform

arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke

EJB business methods via reflection without sufficient authorization

enforcement or input restriction.

Both the deprecated InvokeEJBServlet and the...