CVE-2021-35464 ForgeRock Access Management (AM) Core Server Remote Code Execution
Unauthenticated attackers can achieve remote code execution on ForgeRock AM servers via a crafted request exploiting a Java deserialization flaw.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-35464?
CVE-2021-35464 is a critical unsafe deserialization vulnerability in n/a, published on 22 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier
Weakness: CWE-502
Which versions are affected by CVE-2021-35464?
It affects 2 products.
Products include Forgerock Access Management, Forgerock Openam.
How do I fix CVE-2021-35464?
No fix has been published for CVE-2021-35464 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2021.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-35464 being exploited?
Yes. Attackers have exploited CVE-2021-35464 in the wild since at least 3 Nov 2021, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6x75-vwp5-q242.