QID 150623

Date Published: 2022-12-12

QID 150623: ForgeRock Access Management Remote Code Execution Vulnerability (CVE-2021-35464)

ForgeRock AM server provides a service called access management, which manages access to resources, such as a web page, an application, or web service, available over the network.

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier.

Affected Versions:
ForegeRock Access Management version 5.x
ForgeRock Access Management versions 6.0.0.x, 6.5.0.x, 6.5.1, 6.5.2.x and 6.5.3
OpenAM versions 9.x, 10.x, 11.x, 12.x and 13.x

QID Detection Logic (Unauthenticated):
This QID sends specially crafted HTTP GET/POST request with command injection payloads where vulnerable servers will execute system commands or make a DNS query that will trigger Qualys Periscope detection mechanism

Successful exploitation of this vulnerability may allow an unauthenticated remote attacker to execute arbitrary code on the target system.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as Critical - 10 severity.
    • Solution
    Please refer to ForgeRock Access Management Security Advisory Page for updates and patch information.
    Vendor References

    CVEs related to QID 150623

    CVE-2021-35464 |
    Software Advisories
    Advisory ID Software Component Link
    ForgeRock Access Management Security Advisory URL Logo backstage.forgerock.com/knowledge/kb/article/a47894244
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].