A critical flaw was identified in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows attackers to bypass the denylist originally introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url parameter from POST requests and passes it directly to JMXServiceURL and JMXConnectorFactory without adequate filtering. The existing denylist only blocks URLs matching 'service:jmx:rmi:///jndi/ldap:.*', which can be bypassed using alternative JMX service URL forms such as ldaps:// schemes or LDAP URLs with non-empty JMX host components. These bypass URLs are accepted as valid JMXServiceURL objects, causing the Jolokia agent JVM to perform JNDI lookups against attacker-controlled LDAP endpoints. The vulnerability can result in server-side request forgery (SSRF), credential forwarding to remote endpoints, and potentially remote code execution depending on the target JVM configuration and available classes.
