CVE-2017-15708 Remote Code Execution in Apache Synapse

What is CVE-2017-15708?

CVE-2017-15708 is a critical unsafe deserialization vulnerability in Oracle Peoplesoft Enterprise Peopletools, published on 11 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Weakness: CWE-74

Which versions are affected by CVE-2017-15708?

2 open source packages ship an affected version, including org.apache.synapse:synapse-core. It affects 3 products.

Products include Apache Synapse, Oracle Financial Services Market Risk Measurement and Management, Oracle Peoplesoft Enterprise Peopletools.

How do I fix CVE-2017-15708?

Upgrade org.apache.synapse:synapse-core to 3.0.1 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2017-15708 being exploited?

There is no known exploitation of CVE-2017-15708 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p694-23q3-rvrc.