PT-2017-14153 · Apache · Apache Commons Collections+1

Published

2017-12-11

·

Updated

2022-03-08

·

CVE-2017-15708

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Synapse versions 1.1.1 through 3.0.1
Description The issue allows remote code execution attacks by injecting specially crafted serialized objects due to the lack of authentication for Java Remote Method Invocation (RMI) in Apache Synapse. The presence of Apache Commons Collections 3.2.1 or previous versions makes this exploitable.
Recommendations For Apache Synapse versions 1.1.1 through 3.0.0, limit RMI access to trusted users only as a temporary mitigation measure. For Apache Synapse versions 1.1.1 through 3.0.0, upgrade to version 3.0.1 to eliminate the risk associated with the vulnerable Commons Collection version. For Apache Synapse version 3.0.1, no additional action is required as Commons Collection has been updated to a non-vulnerable version.

Fix

Special Elements Injection

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-74CWE-502

Related Identifiers

CVE-2017-15708
GHSA-P694-23Q3-RVRC

Affected Products

Apache Commons Collections
Apache Synapse