Apache Tomcat JMX Risks Explained

This blog post details how exposing Tomcat's JMX service can lead to full server compromise: it shows how attackers can read manager credentials via MBeans, abuse the AccessLogValve.rotate operation to create JSP web shells for remote command execution, enumerate session IDs to hijack users, capture SMB challenge-responses, and brute-force JMX authentication; the author provides proof-of-concept steps, tools, and mitigations (firewalling, strong auth/SSL, restricting rotate behavior, hashing manager passwords).