漏洞描述
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
portswigger.nethttps://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464↗cve.mitre.orghttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35464↗packetstormsecurity.comhttp://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html↗packetstormsecurity.comhttp://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html↗bugster.forgerock.orghttps://bugster.forgerock.org↗