CVE-2017-5641 Apache Flex BlazeDS unsafe deserialization

What is CVE-2017-5641?

CVE-2017-5641 is a critical unsafe deserialization vulnerability in Apache Flex Blaze DS, published on 28 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other, unknown types may also exhibit such behaviors. One vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable Java deserialization of untrusted data. Other known vectors in third party libraries can be used to trigger remote code execution.

Weakness: CWE-502

Which versions are affected by CVE-2017-5641?

4 open source packages ship an affected version, including org.apache.flex.blazeds:flex-messaging-core and org.apache.flex.blazeds:flex-messaging-remoting. It affects 2 products.

Products include Apache Flex Blazeds, Hp Xp Command View Advanced Edition.

How do I fix CVE-2017-5641?

Upgrade org.apache.flex.blazeds:flex-messaging-core to 4.7.3 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2017-5641 being exploited?

There is no known exploitation of CVE-2017-5641 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w8v7-prhw-xjpw.