Pre-auth RCE in Forge Rock OpenAM (CVE-2021-35464)
Summary: Researcher @artsploit found a pre-auth RCE in ForgeRock OpenAM, caused by unsafe Java deserialization in the legacy Jato framework: a request containing a 'jato.pageSession' query parameter is deserialized via ObjectInputStream with compression on top, reachable without authentication through endpoints such as '/ccversion/Version'. The vulnerability was patched in ForgeRock AM 7.0 by removing the '/ccversion' endpoint and other legacy Jato endpoints, and does not affect instances running Java 9 or newer because Jato requires classes removed in Java 9.
What's compelling: The exploit worked on live bug bounty targets, not just a lab: the researcher bypassed a reverse proxy restricting access to '/openam/oauth2/' using the Tomcat '..;/' path traversal trick, then executed a 'sleep 10' command and the 'id' command blindly. Jato has not been updated for many years, so any other product still relying on it may remain exposed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-35464
- Related
- CVE-2021-35464: Forge Rock Access Management (AM) Core Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021