CVE-2021-35464

CRITICAL9.8Insecure deserialization

CISA KEVRansomwarePublic PoCTrendingHigh EPSS

Description

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Exploits & proofs of concept

nucleiForgeRock OpenAM <7.0 - Remote Code Executionby madrobot

References

MISChttps://bugster.forgerock.org
EXPLOIThttp://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html
EXPLOIThttp://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html
MISChttps://backstage.forgerock.com/knowledge/kb/article/a47894244