K30518307 : Java commons-collections library vulnerability CVE-2015-4852

Security Advisory Description

• CVE-2015-4852

Java applications that have an endpoint that accepts serialized Java objects, an attacker can combine serializable collections to create arbitrary remote code execution. Based on the FoxGlove, an attack can be done via RMI or HTTP. The vulnerability is actually in InvokerTransformer class. If class path exists for commons-collections or commons-collections4, the vulnerability exits in the application.

• Apache Collections-580 - Arbitrary remote code execution with InvokerTransformer

With InvokerTransformer, serializable collections can be build that execute arbitrary Java code. sun.reflect.annotation.AnnotationInvocationHandler#readObject invokes #entrySet and #get on a deserialized collection. If you have an endpoint that accepts serialized Java objects (JMX, RMI, remote EJB, …) you can combine the two to create arbitrary remote code execution vulnerability.
Impact
The Java common-collections library is shipped with some F5 products, and a local attacker who can send a serialized Java object to the local host could expose the vulnerability.