ForgeRock OpenAM Deserialization RCE (CVE-2021-35464)

Exploits CVE-2021-35464 in ForgeRock OpenAM 7.0: pre-auth Java deserialization via jato.pageSession on /openam/oauth2/..;/ccversion/ path traversal routes. !/usr/bin/env python3 -- coding: utf-8 -- """ForgeRock OpenAM Jato deserialization RCE CVE-2021-35464.""" import re from kittysploit import...

ForgeRock OpenAM <7.0 - Remote Code Execution Detection

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

CVE-2021-35464

CVE-2021-35464 affects ForgeRock OpenAM/Access Management: Java deserialization in the JATO framework allows pre-auth remote code execution on ForgeRock AM Core Server when running versions prior to 7.0. An attacker can trigger RCE by sending a crafted HTTP request to endpoints like /ccversion/Ve...

CVE-2021-35464: Deserialization of Untrusted Data

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...